CVE-2025-32103: crushftp Path Traversal — Exploit

Description

CrushFTP 9.x and 10.x through 10.8.4 and 11.x through 11.3.1 allows directory traversal via the /WebInterface/function/ URI to read files accessible by SMB at UNC share pathnames, bypassing SecurityManager restrictions.

Is your site exposed to CVE-2025-32103?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

5.0

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N

Weakness Type (CWE)

CWE-40 CWE-40

CWE-22 Path Traversal

Affected Products

Vendor	Product	Versions
crushftp	crushftp	9.0.0 — 11.3.1

References

Exploits

https://packetstorm.news/files/id/190460/ https://seclists.org/fulldisclosure/2025/Apr/17 https://seclists.org/fulldisclosure/2025/Apr/17

Other References

https://www.crushftp.com/ http://seclists.org/fulldisclosure/2025/Apr/17

Frequently Asked Questions

What is CVE-2025-32103? +

CrushFTP 9.x and 10.x through 10.8.4 and 11.x through 11.3.1 allows directory traversal via the /WebInterface/function/ URI to read files accessible by SMB at UNC share pathnames, bypassing SecurityManager restrictions. It has a CVSS v3.1 base score of 5.0 (MEDIUM).

How severe is CVE-2025-32103? +

CVE-2025-32103 has a CVSS v3.1 score of 5.0 out of 10, rated MEDIUM. This is a medium-severity vulnerability that should be remediated as part of regular maintenance.

What products are affected by CVE-2025-32103? +

CVE-2025-32103 affects products from crushftp, specifically: crushftp. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2025-32103? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2026-25039 8.8

Parsec is a cloud-based application for simple and cryptographically secure file sharing. The application does not sanitize the workspace name, …

CVE-2023-29446 4.7

An improper input validation vulnerability has been discovered that could allow an adversary to inject a UNC path via a …

CVE-2024-53552 9.8

CrushFTP 10 before 10.8.3 and 11 before 11.2.3 mishandles password reset, leading to account takeover.

CVE-2025-31161 9.8

CrushFTP 10 before 10.8.4 and 11 before 11.3.1 allows authentication bypass and takeover of the crushadmin account (unless a DMZ …

CVE-2024-4040 9.8

A server side template injection vulnerability in CrushFTP in all versions before 10.7.1 and 11.1.0 on all platforms allows unauthenticated …

CVE-2025-54309 9.0

CrushFTP 10 before 10.8.5 and 11 before 11.3.4_23, when the DMZ proxy feature is not used, mishandles AS2 validation and …

CVE-2025-32103