CrushFTP Authentication Bypass Attack

Actively targeted File transfer solution

FortiGuard Labs has identified ongoing and persistent attack attempts in the wild that are aimed at exploiting CVE-2025-31161, which is an authentication bypass vulnerability found in CrushFTP file transfer server. If successfully exploited, this vulnerability could allow attackers to gain administrative access to the application, representing a significant risk to enterprise environments. Learn More »

Common Vulnerabilities and Exposures

Background

An attacker may take advantage of this vulnerability by sending a specifically crafted HTTP request to the CrushFTP server. If exploited, this vulnerability could result in complete system compromise. Attackers would be able to impersonate users, execute administrative actions, access sensitive information, and upload harmful content.

This vulnerability is remotely exploitable, and a proof-of-concept (PoC) exploit is now publicly accessible. This situation heightens the risk of swift adoption by threat actors, including ransomware groups that have previously targeted other Managed File Transfer (MFT) platforms such as MOVEit Transfer and Cleo MFT.

The versions affected range from 10.0.0 to 10.8.3 and from 11.0.0 to 11.3.0. Users are strongly advised to promptly update to versions 10.8.4 or 11.3.1 and later.