Back to Database
Status published
Medium
CVE-2025-32103
CrushFTP 9.x and 10.x through 10.8.4 and 11.x through 11.3.1...
Vulnerability Description
CrushFTP 9.x and 10.x through 10.8.4 and 11.x through 11.3.1 allows directory traversal via the /WebInterface/function/ URI to read files accessible by SMB at UNC share pathnames, bypassing SecurityManager restrictions.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-32103
Credits & Attribution
No credits recorded in the NVD database.
References
More from CrushFTP
View All →CVE-2025-54309
CrushFTP 10 before 10.8.5 and 11 before 11.3.4_23, when the...
Critical
9
CVE-2025-32102
CrushFTP 9.x and 10.x through 10.8.4 and 11.x through 11.3.1...
Medium
5
CVE-2025-31161
CrushFTP 10 before 10.8.4 and 11 before 11.3.1 allows authentication...
Critical
9.8
CVE-2024-4040
Unauthenticated arbitrary file read and remote code execution in CrushFTP
Critical
9.8
Affected Vendor
CrushFTP
View all reports →Affected Software
CrushFTP
Vulnerable Versions:
9, 11
Timeline
Official Publish:
April 15th, 2025
Last Modified:
November 3rd, 2025
Added to House:
July 22nd, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N
Weaknesses (CWE)
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.