CVE-2025-63420

MEDIUM 4.1CVE-2025-63420 · Published 07/11/2025 · updated 17/06/2026

In short

CVE-2025-63420 is a MEDIUM (CVSS 4.1) vulnerability affecting crushftp (crushftp).
Chance of exploitation in the next 30 days (EPSS): 0.29%, higher than 21.5% of all vulnerabilities.
Fix: update to 11.3.7_57 or later.

Package	Affected versions	Patched versions
crushftp crushftp	`≥ 11.0.1, < 11.3.7_57`	`11.3.7_57`

Description

CrushFTP11 before 11.3.7_57 is vulnerable to stored HTML injection in the CrushFTP Admin Panel (Reports / "Who Created Folder"), enabling persistent HTML execution in admin sessions.

References

gist.github.com/MMAKINGDOM/791d264c27656f0a4aa3c0ae35075e70 · Exploit
MMAKINGDOM/CVE-2025-63420 · Exploit

More vulnerabilities in crushftp

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

crushftp

≥ 11.0.1, < 11.3.7_57

11.3.7_57

More vulnerabilities in crushftp

See all →