CrushFTP crushadmin Authentication Bypass Vulnerability

Description

CrushFTP 10 (<=10.8.3) and 11 (<=11.3.0) have a race condition in AWS4-HMAC auth that allows unauthenticated users to bypass login and gain crushadmin access, enabling full system compromise.

Outbreak Alert

FortiGuard Labs has identified ongoing and persistent attack attempts in the wild that are aimed at exploiting CVE-2025-31161, which is an authentication bypass vulnerability found in CrushFTP file transfer server. If successfully exploited, this vulnerability could allow attackers to gain administrative access to the application, representing a significant risk to enterprise environments.

View the full Outbreak Alert Report

Affected Applications

CrushFTP

References