Raw vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:NSummary
CVE-2025-32103 is a medium-severity Windows UNC Share (CWE-40) vulnerability in Crushftp Crushftp. Its CVSS base score is 5.0 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Forced Authentication (T1187); ranked in the top 3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and SI-10 (Information Input Validation) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-10974
Vulnerability Data
CrushFTP 9.x and 10.x through 10.8.4 and 11.x through 11.3.1 allows directory traversal via the /WebInterface/function/ URI to read files accessible by SMB at UNC share pathnames, bypassing SecurityManager restrictions.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V5.3.2
Mitigating Controls (NIST 800-53 r5) AI
Enforces the intended directory access authorizations that path traversal would otherwise bypass.
Input validation directly rejects malformed or malicious UNC paths before they are resolved to unintended locations.
Least privilege reduces the impact of any unauthorized file access obtained via traversal.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly prevent introduction of unsafe path-handling code such as UNC traversal.
Identifying and recording vulnerabilities enables discovery and remediation of path traversal flaws before exploitation.
Least-privilege enforcement limits the damage an attacker can achieve via a malicious UNC path.
Patching/maintenance can remediate known path-traversal flaws in deployed software (partial prevention of exploitability) but does nothing to stop the coding defect from being introduced in the first place.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can discover and verify the absence of UNC-based path traversal vulnerabilities.
Network security controls can block or filter UNC paths that traverse outside approved shares.
Secure SDLC mandates input validation and path sanitization that directly prevent path traversal.
Application security requirements can mandate input validation to reject malicious UNC paths.
Secure architecture principles include canonicalization and path-handling controls that prevent UNC traversal.
Secure coding standards directly require validation and sanitization of file paths including UNC shares.