CrushFTP CVE-2025-31161 auth bypass user creation

CVE-2025-31161: crafted CrushAuth / AWS4 Authorization headers allow unauthenticated setUserItem on /WebInterface/function/, creating a new FTP/WebInterface user. Default is detect-only; set confirm=true to create the configured account destructive. !/usr/bin/env python3 -- coding: utf-8 --...