CVE-2025-31161: CrushFTP authentication bypass in AWS4-HMAC (S3) authorization
Exploited in the wild Critical 9.8 EPSS 100.0%
A flaw in the HTTP(S) component's AWS4-HMAC (S3-compatible) authorization lets a remote attacker log in as any known or guessable user, such as crushadmin, without a password and take over the server. CrushFTP 10 and 11 are affected unless a DMZ proxy instance sits in front. Fixed in 10.8.4 and 11.3.1 (21 March 2025) and exploited in the wild in March and April 2025; CISA added it to KEV on 7 April 2025 and lists it as used in ransomware campaigns.
- CVE-2025-31161CVE identifier
- 9.8CVSS 3.1 base score (critical)
- 2025-04-07added to CISA's exploited list (US federal deadline 2025-04-28)
- 100.0%EPSS: chance of exploitation in the next 30 days (higher than 100% of CVEs)
- 2025-04-03published
What do these terms mean? CVE · CVSS score · exploited (KEV) · EPSS · backported fix · all terms
What to do now
- Check whether you run the affected software and which version (commands below).
- Install the fixed version for your system: see “Patch it” below.
- CrushFTP 11 rarely needs a service restart after an update (vendor); restart the crushftp service if the version does not change.
- If you cannot patch today, apply the temporary mitigation below and patch as soon as possible.
- Because this flaw is being exploited, also check the server for signs of compromise.
Affected and fixed versions
Affected:
- CrushFTP 10 before 10.8.4
- CrushFTP 11 before 11.3.1
Fixed in:
- CrushFTP 10.8.4
- CrushFTP 11.3.1
Patch it
Use the commands for your system. Distribution packages often keep an older version number with the fix backported, so compare with the fixed package versions in the table below, not only with the upstream version.
Built from source
# Admin web interface > About > Update (or enable Preferences > Updates > automatic updating).
# Install 11.3.5 or later / 10.8.5 or later to also fix CVE-2025-54309.General update steps for every system are on the Linux and Unix & BSD pages; after updating, see which services to restart.
If you cannot patch yet
- A DMZ proxy instance of CrushFTP in front of the main server blocks this exploit (vendor).
CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
https://www.crushftp.com/crush11wiki/Wiki.jsp?page=Update ; https://nvd.nist.gov/vuln/detail/CVE-2025-31161
Related vulnerabilities
Sources
- CVE record CVE-2025-31161
- NVD CVE-2025-31161
- CISA KEV entry CVE-2025-31161
- CrushFTP Update page and vulnerability info
- Outpost24: CrushFTP authentication bypass
- https://crushftp.com/crush11wiki/Wiki.jsp?page=Update#section-Update-VulnerabilityInfo
- CISA Known Exploited Vulnerabilities catalog
Page generated automatically from official sources on 2026-11-03 18:05 UTC and reviewed by an editor. Always confirm with your vendor's advisory.