CrushFTP before 7.3.0 Cross-Site Request Forgery via /WebInterface/function/

Advisories

CrushFTP before 7.3.0 Cross-Site Request Forgery via /WebInterface/function/

Severity: high
Date: 10/27/2026
Affecting: CrushFTP >= 0, < 7.3.0
CVE: CVE-2015-20129
CWE: CWE-352 Cross-Site Request Forgery (CSRF)
CVSS: 8.6
CVSS V4 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
References: ExploitDB-36126: CrushFTP 7.2.0 Multiple Vulnerabilities
CrushFTP 7 Release Notes
Credit: Rehan Ahmed
Description: CrushFTP before 7.3.0 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions because CSRF protection is disabled by default. Attackers can lure an authenticated administrator to a malicious page that submits POST requests to commands like setUserItem, creating root-access users or changing server configuration.

Ready to get Started?

Explore VulnCheck, a next-generation Cyber Threat Intelligence platform, which provides exploit and vulnerability intelligence to help you prioritize and remediate vulnerabilities that matter.

Vulnerability Prioritization
Prioritize vulnerabilities that matter based on the threat landscape and defer vulnerabilities that don't.
Early Warning System
Real-time alerting of changes in the vulnerability landscape so that you can take action before the attacks start.

Schedule a Demo