CVE-2015-20129: CrushFTP before 7.3.0 Cross-Site Request Forgery via /WebInterface/function/

Q: Who is exposed to this issue?

CrushFTP deployments before 7.3.0 are exposed when an administrator is authenticated to the web interface. CSRF protection is disabled by default, so a default configuration is affected.

Q: What does an attacker need to exploit it?

The attacker does not need credentials, but must lure an authenticated administrator into visiting a malicious page. That page can submit POST requests to the /WebInterface/function/ endpoint.

Q: What actions could exploitation perform?

The available examples include invoking commands such as setUserItem to create users with root access or alter server configuration. The vulnerability can affect confidentiality, integrity, and availability.

Q: What version resolves the issue?

The issue affects versions before 7.3.0. Upgrading to version 7.3.0 or later removes the affected version range described here.

Published Oct 28, 2026

Updated

CrushFTP before 7.3.0 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions because CSRF protection is disabled by default. Attackers can lure an authenticated administrator to a malicious page that submits POST requests to commands like setUserItem, creating root-access users or changing server configuration.

Affected Software

1 affected component

CrushFTP CrushFTP<7.3.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade CrushFTP to a version that resolves this vulnerability.
Fixed in 7.3.0

Event History

Oct 28, 2026

CVE Published

via MITRE·02:03 AM

Data Sourced

via MITRE·02:03 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

CrushFTP deployments before 7.3.0 are exposed when an administrator is authenticated to the web interface. CSRF protection is disabled by default, so a default configuration is affected.

What does an attacker need to exploit it?

The attacker does not need credentials, but must lure an authenticated administrator into visiting a malicious page. That page can submit POST requests to the /WebInterface/function/ endpoint.

What actions could exploitation perform?

The available examples include invoking commands such as setUserItem to create users with root access or alter server configuration. The vulnerability can affect confidentiality, integrity, and availability.

What version resolves the issue?

The issue affects versions before 7.3.0. Upgrading to version 7.3.0 or later removes the affected version range described here.

CVE-2015-20129: CrushFTP before 7.3.0 Cross-Site Request Forgery via /WebInterface/function/

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What actions could exploitation perform?

What version resolves the issue?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What actions could exploitation perform?

What version resolves the issue?