CrushFTP Vulnerability (CVE-2025-54309): Securing File Transfer Services
Overview On July 18, 2025, CrushFTP disclosed a critical vulnerability (CVE-2025-54309, CVSS 9.0) in versions 10 before 10.8.5 and 11 before 11.3.4_23, exploited via HTTP(S) to gain admin access. The flaw, related to AS2 validation mishandling, allows remote attackers to bypass authentication when the DMZ proxy feature is disabled. Explanation The vulnerability arises from improper… Read More »CrushFTP Vulnerability (CVE-2025-54309): Securing File Transfer Services

