CVE-2025-63419: 
CrushFTP vulnerability analysis and mitigation

CVE-2025-63419 is an HTML Injection / Cross-Site Scripting (XSS) vulnerability in CrushFTP's web-based file sharing feature. Discovered by researcher Muntadhar M. Ahmed (almuntadhar0x01) and first published on November 12, 2025, the flaw affects CrushFTP versions before 11.3.7_60, with the specific version confirmed vulnerable being 11.3.6_48. The vulnerability arises because filenames are reflected unsanitized into the email body field of the file sharing workflow, enabling HTML injection. The CVSS v3.1 base score is 6.1 (Medium) per NVD, though the researcher's own assessment rates it 3.5 (Low) (Feedly, GitHub PoC).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically a reflected XSS/HTML injection via unsanitized filename input. CrushFTP's file sharing feature intentionally supports limited HTML in the email body field, but fails to sanitize filenames before reflecting them into that field — meaning an attacker with "Rename" permissions can craft a filename containing HTML or JavaScript tags (e.g., test<b>HACKED</b>test.txt) that are rendered in the email body when the share action is triggered. The issue is Linux-specific, as Windows file systems reject special characters in filenames that would be required for injection. Exploitation requires the attacker to have both "Rename" and "Share" permissions on a server folder (GitHub Gist, GitHub PoC).

Successful exploitation allows an attacker to inject arbitrary HTML or JavaScript into the email body field rendered in other users' browsers during the file sharing workflow, potentially enabling session hijacking, credential theft, or unauthorized actions performed in the context of the victim's browser session. The scope is changed (S:C in CVSS), meaning the injected content can affect users beyond the attacker's own session. Confidentiality and integrity impacts are rated low, and there is no availability impact; however, the ability to steal session tokens or credentials could facilitate further privilege escalation within the CrushFTP environment (Feedly, GitHub PoC).

Public proof-of-concept code and a detailed reproduction guide are available on GitHub, published by the original researcher (GitHub Gist, GitHub PoC). There is no evidence of in-the-wild exploitation or threat actor attribution at this time. The EPSS score is approximately 0.029% (0.000290), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires an authenticated user account with both "Rename" and "Share" permissions, limiting the attacker pool (Feedly).

1. Obtain Permissions: Gain access to a CrushFTP account (on a Linux server) with both "Rename" and "Share" permissions on a target folder, either through legitimate credentials or prior compromise.
2. Upload or Identify a File: Navigate to the CrushFTP web interface at http://<target>:8080/ and select or upload a file to the shared folder.
3. Rename the File with a Malicious Payload: Click "Rename" and change the filename to one containing an HTML/JavaScript payload, e.g., test<script>alert(document.cookie)</script>test.txt or test<b>HACKED</b>test.txt.
4. Trigger the Share Feature: Select the renamed file and click "Share" to initiate the file sharing workflow. The application reflects the unsanitized filename into the email body field.
5. Victim Interaction: When the share notification is sent or viewed by another user, the injected HTML/JavaScript executes in their browser context, potentially stealing session cookies or performing actions on their behalf (GitHub Gist, GitHub PoC).

• File System: Files with unusual names containing HTML tags or JavaScript syntax (e.g., <script>, <b>, <img src=x onerror=...>) in shared directories on Linux CrushFTP servers.
• Logs: CrushFTP access logs showing rename operations followed immediately by share actions for files with special characters or HTML-like strings in filenames.
• Network: Outbound connections from victim browsers to attacker-controlled domains shortly after interacting with a CrushFTP share notification email, potentially indicating successful XSS payload execution.
• Application Logs: Entries in CrushFTP logs reflecting filenames with <, >, or & characters being passed to the email body generation function (GitHub Gist).

Upgrade CrushFTP to version 11.3.7_60 or later, which is the first version to address this vulnerability (GitHub PoC). As a temporary workaround, administrators should restrict "Rename" and "Share" permissions to only trusted users, or disable the file sharing feature entirely until patching is feasible. Implementing a Web Application Firewall (WAF) with rules to filter HTML/JavaScript characters in filename parameters can provide additional defense-in-depth. Input validation and output encoding on all user-supplied filenames before rendering them in email bodies is the recommended long-term fix (GitHub Gist).