Cyber Resilience

CVE-2025-32103

Path Traversal in Crushftp 9.0.0 – 11.3.1

Public PoCPath Traversal
Published
15 April 2025
Modified
03 November 2025
Patch / advisory
CVSS Score v3.1 5.0
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N
EPSS Score 0.17 97th percentile
Risk Priority 51 floored blend · peak EPSS

Summary

CVE-2025-32103 is a medium-severity Windows UNC Share (CWE-40) vulnerability in Crushftp Crushftp. Its CVSS base score is 5.0 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Forced Authentication (T1187); ranked in the top 3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and SI-10 (Information Input Validation) — see the control section below for these in your framework.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability Data

CrushFTP 9.x and 10.x through 10.8.4 and 11.x through 11.3.1 allows directory traversal via the /WebInterface/function/ URI to read files accessible by SMB at UNC share pathnames, bypassing SecurityManager restrictions.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise Techniques

T1187 Forced Authentication Credential Access
Adversaries may gather credential material by invoking or forcing a user to automatically provide authentication information through a mechanism in which they can intercept.
T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2024-25156Same product class: managed file transfer
CVE-2025-21048Shared CWE-22
CVE-2026-23939Shared CWE-22
CVE-2024-7145Shared CWE-22
CVE-2023-42225Shared CWE-22
CVE-2024-33109Shared CWE-22
CVE-2023-35016Shared CWE-22
CVE-2025-10723Shared CWE-22
CVE-2023-1163Shared CWE-22
CVE-2024-43996Shared CWE-22

Affected Assets

crushftp
crushftp
9.0.0 — 11.3.1

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

Detect
Catch it (NIST detect / respond)

Harden
Shrink the surface (DISA STIG)

Validate
Prove the fix (OWASP ASVS)
  • V5.3.2

Mitigating Controls (NIST 800-53 r5) AI

Enforces the intended directory access authorizations that path traversal would otherwise bypass.

Input validation directly rejects malformed or malicious UNC paths before they are resolved to unintended locations.

Least privilege reduces the impact of any unauthorized file access obtained via traversal.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC practices directly prevent introduction of unsafe path-handling code such as UNC traversal.

ID.RA-01 partial match
prevents

Identifying and recording vulnerabilities enables discovery and remediation of path traversal flaws before exploitation.

PR.AA-05 partial match
prevents

Least-privilege enforcement limits the damage an attacker can achieve via a malicious UNC path.

PR.PS-02 partial match
prevents

Patching/maintenance can remediate known path-traversal flaws in deployed software (partial prevention of exploitability) but does nothing to stop the coding defect from being introduced in the first place.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

finds

Security testing can discover and verify the absence of UNC-based path traversal vulnerabilities.

degrades

Network security controls can block or filter UNC paths that traverse outside approved shares.

prevents

Secure SDLC mandates input validation and path sanitization that directly prevent path traversal.

prevents

Application security requirements can mandate input validation to reject malicious UNC paths.

prevents

Secure architecture principles include canonicalization and path-handling controls that prevent UNC traversal.

prevents

Secure coding standards directly require validation and sanitization of file paths including UNC shares.

References