Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2025-32102

CrushFTP 9.x and 10.x through 10.8.4 and 11.x through 11.3.1 allows SSRF via the host and port parameters in a command=telnetSocket request to the /WebInterface/function/ URI.

Published

2025-04-15T13:15:54.783

Last Modified

2025-11-03T20:18:26.620

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 5.0 (MEDIUM)

Weaknesses

Type: Secondary
CWE-918

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	crushftp	crushftp	≤ 11.3.1	Yes

References

https://packetstorm.news/files/id/190460/ Exploit, Third Party Advisory, VDB Entry ([email protected])
https://seclists.org/fulldisclosure/2025/Apr/17 Mailing List, Third Party Advisory ([email protected])
https://www.crushftp.com/ Product ([email protected])
http://seclists.org/fulldisclosure/2025/Apr/17 (af854a3a-2127-422b-91ae-364da2661108)
https://seclists.org/fulldisclosure/2025/Apr/17 Mailing List, Third Party Advisory (134c704f-9b21-4f2e-91b3-4a467353bcc0)