Reference page — cumulative record through Sunday, October 4, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2024-4040

CVE-2024-4040CRITICAL

CrushFTP CrushFTP — Unauthenticated arbitrary file read and remote code execution in CrushFTP

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  H  H    9.8   .9954   99.9   YES

AFFECTED
  Product   Versions  Fixed
  CrushFTP  10.0 –    —

TIMELINE
  Apr 22  Reserved by directcyber
  Apr 22  Published (CNA: directcyber)
  Apr 24  Added to CISA KEV, remediation due 2024-05-01

CWE-1336 · CNA: directcyber · CVSS v3.1 · 8 references · KEV due May 1, 2024

Description

A server side template injection vulnerability in CrushFTP in all versions before 10.7.1 and 11.1.0 on all platforms allows unauthenticated remote attackers to read files from the filesystem outside of the VFS Sandbox, bypass authentication to gain administrative access, and perform remote code execution on the server.

Lifecycle

Complete event history — 3 events, chronological
Date	Event	Detail
April 22, 2024	Reserved	Reserved by directcyber
April 22, 2024	Published	Published (CNA: directcyber)
April 24, 2024	KEV ADDED	Added to CISA KEV, remediation due 2024-05-01

Affected

Affected products and packages — 1 row
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
CrushFTP	CrushFTP	—	10.0	—

Weaknesses

CWE-1336

References (8)

https://github.com/airbus-cert/CVE-2024-4040 [exploit]
https://www.bleepingcomputer.com/news/security/crushftp-warns-users-to-patch-exploited-zero-day-immediately/ [media-coverage]
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-4040 [government-resource]
https://www.crushftp.com/crush10wiki/Wiki.jsp?page=Update [vendor-advisory]
https://www.crushftp.com/crush11wiki/Wiki.jsp?page=Update [vendor-advisory]
https://www.rapid7.com/blog/post/2024/04/23/etr-unauthenticated-crushftp-zero-day-enables-complete-server-compromise/ [third-party-advisory]
https://www.reddit.com/r/crowdstrike/comments/1c88788/situational_awareness_20240419_crushftp_virtual/ [third-party-advisory]
https://www.reddit.com/r/cybersecurity/comments/1c850i2/all_versions_of_crush_ftp_are_vulnerable/ [related]

Authoritative record: CVE-2024-4040 at cve.org

Vendors: crushftp

Weaknesses: CWE-1336

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2024-4040 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Sunday, October 4, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.