2025-015: Critical vulnerability in CrushFTP

2025-015: Critical vulnerability in CrushFTP ↗ source

April 3, 2025 CERT-EU Advisory

Source: https://cert.europa.eu/publications/security-advisories/2025-015/

Summary

It is recommended updating affected server as soon as possible [1,2]. Proof of concepts are available, and the vulnerability is being exploited in the wild. Due to failures in the vulnerability disclosure process, the vulnerability has been assigned more than one CVE identifiers, i.e. CVE-2025-31161 and CVE-2025-2825, with a CVSS score of 9.8. The vulnerability is an authentication bypass vulnerability in the AWS4-HMAC authorisation method of the HTTP component of the CrushFTP server [2]. The vulnerability affects CrushFTP version 10 (prior to 10.8.4) and 11 (prior to 11.3.1) CERT-EU recommends updating the affected products to the latest version as soon as possible.

News Coverage

No coverage found in monitored research blogs or news feeds.

CVEs Referenced in This Publication

CVE	CVSS	Affected
CVE-2025-2825	9.8 Critical	CrushFTP CrushFTP CrushFTP versions 10.0.0 through 10.8.3 and 11.0.0 through 11.3.0 are affected by a vulnerability in the S3 authorization header processing that allo…
CVE-2025-31161	9.8 Critical	CrushFTP CrushFTP CrushFTP contains an authentication bypass vulnerability in the HTTP authorization header that allows a remote unauthenticated attacker to authentica…

Extracted from the publication text. Each CVE links to its tracked detail page.

Vendors Named in This Publication

CrushFTP 3 KEV

Each vendor links to its Known Exploited Vulnerabilities catalog page. Only vendors that appear in the KEV catalog are listed, either because the publication cites one of their KEV entries or because it names them directly.