Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HSummary
CVE-2024-4040 is a critical-severity Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336) vulnerability in Crushftp Crushftp. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Template Injection (T1221); ranked in the top 0.1% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SI-10 (Information Input Validation) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2024-4040 is a server-side template injection vulnerability affecting CrushFTP versions prior to 10.7.1 and 11.1.0 across all platforms. The flaw, tracked under CWE-1336 and CWE-94, permits unauthenticated remote attackers to escape the virtual file system sandbox, read arbitrary files on the underlying host, bypass authentication controls, and execute arbitrary code with administrative privileges.
Unauthenticated attackers with network access can exploit the issue by submitting crafted template expressions that are processed on the server. Successful exploitation grants full read access outside the intended VFS boundaries, administrative login bypass, and remote code execution, resulting in complete server compromise as reflected by the CVSS 9.8 base score.
Vendor advisories direct administrators to upgrade immediately to CrushFTP 10.7.1 or 11.1.0; the updates close the template injection vector and are referenced in the official CrushFTP wiki update pages. Public exploit code and technical analyses have been published on GitHub and by Rapid7.
The vulnerability was disclosed as an actively exploited zero-day, with security researchers and media outlets confirming in-the-wild attacks shortly after publication. The associated EPSS score remains elevated, with a current value of 0.9443 and a recorded peak of 0.9679.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-32605
Vulnerability Data
A server side template injection vulnerability in CrushFTP in all versions before 10.7.1 and 11.1.0 on all platforms allows unauthenticated remote attackers to read files from the filesystem outside of the VFS Sandbox, bypass authentication to gain administrative access, and…
more
perform remote code execution on the server.
- CWE(s)
- KEV Date Added
- 24 April 2024
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V1.3.2V1.3.7V1.3.10V1.3.1
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and static analysis can discover missing neutralization of template directives.
Input validation rejects or sanitizes untrusted data before it reaches the template engine, stopping injection of special syntax.
Least privilege limits the damage an injected code fragment can perform once executed.
Requiring documented secure development standards and tools enforces use of safe code-generation APIs and escaping.
Security engineering principles require use of safe templating APIs and proper escaping of external input.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require proper input neutralization in template engines to prevent injection.
PR.DS-10 protects runtime data confidentiality/integrity but has no bearing on neutralizing externally influenced input during code generation, so neither direction shows any preventive effect.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect template-injection flaws but does not itself implement neutralization controls.
Secure development life cycle mandates input validation and sanitization that directly prevents template-injection weaknesses.
Application security requirements explicitly call for neutralizing special elements in template engines.
Secure architecture principles reduce the likelihood of unsafe template processing but do not prescribe specific neutralization techniques.
Secure coding standards require proper escaping or sandboxing of template directives, directly mitigating CWE-1336.
Controls that restrict unauthorized or malicious code from being introduced via external networks or removable media limit opportunities for an attacker to inject and execute arbitrary code.