CVE-2025-32102 Server-side request forgery in CrushFTP

What is CVE-2025-32102?

CVE-2025-32102 is a medium-severity server-side request forgery vulnerability in CrushFTP, published on 15 Apr 2025. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

CrushFTP 9.x and 10.x through 10.8.4 and 11.x through 11.3.1 allows SSRF via the host and port parameters in a command=telnetSocket request to the /WebInterface/function/ URI.

Weakness: CWE-918

Which versions are affected by CVE-2025-32102?

It affects 1 product.

Products include Crushftp Crushftp.

How do I fix CVE-2025-32102?

No fix has been published for CVE-2025-32102 yet. Limit exposure of the affected software until one is available.

Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.

Is CVE-2025-32102 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-32102 exists.

Other vulnerabilities in CrushFTP

• CVE-2025-31161 CrushFTP Authentication Bypass Exploited Critical 9.8
• CVE-2024-4040 CrushFTP VFS Sandbox Escape Exploited Critical 9.8
• CVE-2025-54309 CrushFTP Unprotected Alternate Channel Exploited Critical 9.0
• CVE-2024-53552 Auth bypass in n/a Critical 9.8
• CVE-2023-43177 Deserialization in n/a Critical 9.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-4p7q-hmcp-j657.