A server side template injection vulnerability in CrushFTP in all versions before 10.7.1 and 11.1.0 on all platforms allows unauthenticated remote attackers to read files from the filesystem outside of the VFS Sandbox, bypass authentication to gain administrative access, and perform remote code execution on the server.
Is CVE-2024-4040 exploited?
Listed in the CISA KEV catalog on 2024-04-24.
Federal remediation due 2024-05-01.
Past that date by 836 days.
EPSS puts exploitation in the next 30 days at 99.5%.
Public exploit code: none found in monitored sources.