CVE-2025-31161 CrushFTP CrushFTP
CrushFTP contains an authentication bypass vulnerability in the HTTP authorization header that allows a remote unauthenticated attacker to authenticate to any known or guessable user account (e.g., crushadmin), potentially leading to a full compromise.
- CVSS
- not scored
On CISA’s exploited list
CrushFTP Authentication Bypass Vulnerability
- Added
- 2025-04-07
- Federal patch deadline
- 2025-04-28
- Ransomware use
- known