Exploit for Code Injection in Crushftp

CVE-2024-4040 SSTI & LFI PoC - Exploitation | CrushFTP This...

Exploit for Code Injection in Crushftp

CVE-2024-4040 SSTI & LFI PoC - Exploitation | CrushFTP This...

CVE-2024-4040

CVE-2024-4040 affects CrushFTP prior to 10.7.1 and 11.1.0. Public details describe an unauthenticated server-side template injection that can read files outside the VFS sandbox and may bypass authentication, enabling administrative access and potential remote code execution. Public PoCs and explo...