LiveThreat Vulnerability Brief — CrushFTP Multiple Critical Flaws (CVE‑2024‑4040, CVE‑2025‑31161, CVE‑2025‑54309)
What It Is — CrushFTP, a Java‑based open‑source file‑transfer server, is currently subject to active brute‑force scanning that targets three high‑severity vulnerabilities: a template‑injection RCE (CVE‑2024‑4040), an authentication bypass granting the crushadmin account (CVE‑2025‑31161), and a July‑2025 zero‑day RCE (CVE‑2025‑54309) that is already being exploited in the wild. Exploitability — All three flaws are exploitable without authentication; the zero‑day is confirmed to have active exploits, and public PoCs exist for the template‑injection and auth‑bypass. Affected Products — CrushFTP server releases for Windows, Linux, and macOS; any organization that runs the service, whether on‑prem or in the cloud. TPRM Impact — Third‑party vendors that embed CrushFTP for internal or customer file exchange become a direct attack surface; compromised instances can be leveraged to move laterally, exfiltrate data, or host ransomware payloads against downstream partners. Recommended Actions — Immediately apply the latest patches from the CrushFTP project, enforce strong, unique passwords and MFA for all admin accounts, disable or restrict the crushadmin default login, monitor authentication logs for repeated failures, and consider temporary service isolation until remediation is verified. Source: SANS Internet Storm Center