CrushFTP versions before 7.3.0 allow cross-site request forgery because CSRF protection is disabled by default. A malicious page can submit authenticated POST requests to functions such as setUserItem, enabling an attacker to create users with administrator or root rights, or to modify server configuration. The result is that an attacker who convinces an admin to visit the malicious page can gain full control of the FTP server.

CrushFTP deployments running any version earlier than 7.3.0 are affected, regardless of OS or hosting environment. The vulnerability is tied to the WebInterface function endpoint and applies to all instances that expose the web interface.

The CVSS score of 8.6 classifies the flaw as high severity. Because the exploit relies on a passive attack that requires the victim to load a crafted page while authenticated, the EPSS score is not available but the attack could be used by social engineers targeting administrators. The vulnerability is not listed in CISA's KEV catalog, but its high severity and potential to grant full administrative access make it a priority target for attackers.