CVE-2024-4040: listed in the CISA KEV catalog

CVE-2024-4040 · CVSS 9.8 CRITICAL · EPSS 99.5% · KEV 2024-04-24 · patch available

A server side template injection vulnerability in CrushFTP in all versions before 10.7.1 and 11.1.0 on all platforms allows unauthenticated remote attackers to read files from the filesystem outside of the VFS Sandbox, bypass authentication to gain administrative access, and perform remote code execution on the server.

Is CVE-2024-4040 exploited?

• Listed in the CISA KEV catalog on 2024-04-24.
• Federal remediation due 2024-05-01.
• Past that date by 912 days.
• EPSS puts exploitation in the next 30 days at 99.5%.
• Public exploit code: none found in monitored sources.
• Public detection rules exist.

Which products and versions are affected?

• CrushFTP · CrushFTP · >= 10.0, < 10.7.1, >= 11.0, < 11.1.0

Is there a patch?

Yes. Update to one of these or later:

From CrushFTP's CVE record · CrushFTP advisory

What PlainSec published about CVE-2024-4040

• CrushFTP Admin Accounts Targeted by Brute-Force Scans (2026-03-04)

Primary sources

• NVD record
• CISA KEV catalog
• CrushFTP advisory
• Nuclei template

KEV and EPSS are re-checked daily. Record last updated 2026-09-02.