CVE-2025-32103

PoC ×2—

CVSS 3.1

5.0 medium

EPSS

17%p97

Published

Apr 15, 2025 (Apr 15, 2025)

Modified

Jun 17, 2026

Description

CrushFTP 9.x and 10.x through 10.8.4 and 11.x through 11.3.1 allows directory traversal via the /WebInterface/function/ URI to read files accessible by SMB at UNC share pathnames, bypassing SecurityManager restrictions.

Vendors: crushftp
Products: crushftp
Weakness: CWE-40, CWE-22
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N

NVD CVE.org GitHub PoCs EPSS (16.9%)

In the news0 stories

No ingested article mentions this CVE yet.