Vulnerability in CrushFTP

[ Why it matters ]Priority signals

• Public proof-of-concept exploit exists (CISA SSVC)

[ Description ]Official description

CrushFTP before 7.3.0 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions because CSRF protection is disabled by default. Attackers can lure an authenticated administrator to a malicious page that submits POST requests to commands like setUserItem, creating root-access users or changing server configuration.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

• BSI CERT-Bund27 Oct 2026WID-SEC-2026-4211

  CrushFTP: Vulnerability allows gaining administrator rights Translated from German

  CVE-2015-20129

[ References ]References

• www.crushftp.com/version7.html
• www.exploit-db.com/exploits/36126
• www.vulncheck.com/advisories/crushftp-before-7.3.0-cross-site-request-forgery-via-webin…