CVE-2025-31161

🗓️ 03 Apr 2025 00:00:00Reported by mitreType

cve🔗 web.nvd.nist.gov📰️ 32 Media mentions👁 425 Views🌐 WEB

CrushFTP versions prior to 10.8.4 and 11.3.1 have an authentication bypass vulnerability.

Reporter	Title	Published	Views	Family All 45
GithubExploit	Exploit for Authentication Bypass by Primary Weakness in Crushftp	21 Oct 202517:49	–	githubexploit
GithubExploit	Exploit for Authentication Bypass by Primary Weakness in Crushftp	20 Feb 202613:40	–	githubexploit
GithubExploit	Exploit for Authentication Bypass by Primary Weakness in Crushftp	6 Jun 202509:14	–	githubexploit
GithubExploit	Exploit for Authentication Bypass by Primary Weakness in Crushftp	8 Apr 202515:37	–	githubexploit
GithubExploit	Exploit for Authentication Bypass by Primary Weakness in Crushftp	10 Sep 202500:20	–	githubexploit
GithubExploit	Exploit for Authentication Bypass by Primary Weakness in Crushftp	21 Apr 202523:57	–	githubexploit
GithubExploit	Exploit for Authentication Bypass by Primary Weakness in Crushftp	23 May 202521:04	–	githubexploit
GithubExploit	Exploit for Authentication Bypass by Primary Weakness in Crushftp	29 Oct 202523:17	–	githubexploit
GithubExploit	Exploit for Authentication Bypass by Primary Weakness in Crushftp	29 Jun 202620:41	–	githubexploit
GithubExploit	Exploit for Authentication Bypass by Primary Weakness in Crushftp	29 Jun 202620:51	–	githubexploit

NVD

Vulners

CNA

Node

crushftp crushftpRange10.0.0–10.8.4

crushftp crushftpRange11.0.0–11.3.1

[
  {
    "defaultStatus": "unaffected",
    "product": "CrushFTP",
    "vendor": "CrushFTP",
    "versions": [
      {
        "lessThan": "10.8.4",
        "status": "affected",
        "version": "10",
        "versionType": "custom"
      },
      {
        "lessThan": "11.3.1",
        "status": "affected",
        "version": "11",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
crushftp	www.crushftp.com/crush11wiki/Wiki.jsp
outpost24	www.outpost24.com/blog/crushftp-auth-bypass-vulnerability/
vicarius	www.vicarius.io/vsociety/posts/cve-2025-31161-detect-crushftp-vulnerability
vicarius	www.vicarius.io/vsociety/posts/cve-2025-31161-mitigate-crushftp-vulnerability
attackerkb	www.attackerkb.com/topics/k0EgiL9Psz/cve-2025-2825/rapid7-analysis
darkreading	www.darkreading.com/vulnerabilities-threats/disclosure-drama-clouds-crushftp-vulnerability-exploitation
cisa	www.cisa.gov/known-exploited-vulnerabilities-catalog
projectdiscovery	www.projectdiscovery.io/blog/crushftp-authentication-bypass
infosecurity-magazine	www.infosecurity-magazine.com/news/crushftp-flaw-exploited-disclosure/
huntress	www.huntress.com/blog/crushftp-cve-2025-31161-auth-bypass-and-post-exploitation

Parameter	Position	Path	Description	CWE
Authorization	header	WebInterface/function/	Authentication bypass via crafted AWS4-HMAC header enabling any user login (e.g., crushadmin) due to race condition and header parsing flaw in CrushFTP AWS4-HMAC authorization.	CWE-305
Cookie	header	WebInterface/function/	Authentication bypass via crafted AWS4-HMAC header enabling any user login (e.g., crushadmin) due to race condition and header parsing flaw in CrushFTP AWS4-HMAC authorization.	CWE-305

17 Jun 2026 09:09Current

7.7High risk

Vulners AI Score7.7

CVSS 3.19.8

EPSS0.99963

SSVC