CVE-2025-63420: CrushFTP Stored XSS Vulnerability

CVE-2025-63420 Overview

CVE-2025-63420 is a stored HTML injection vulnerability affecting CrushFTP 11 versions prior to 11.3.7_57. The flaw resides in the CrushFTP Admin Panel, specifically within the Reports section's "Who Created Folder" functionality. An authenticated low-privileged attacker can inject persistent HTML payloads that execute in the context of administrator sessions when the affected report is rendered. The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation).

Critical Impact
Persistent HTML injection into admin sessions can enable UI redressing, phishing overlays, and manipulation of administrative workflows within the CrushFTP management interface.

Affected Products

CrushFTP 11 versions before 11.3.7_57
CrushFTP Admin Panel (Reports module)
"Who Created Folder" reporting feature

Discovery Timeline

2025-11-07 - CVE-2025-63420 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-63420

Vulnerability Analysis

The vulnerability is a stored Cross-Site Scripting / HTML injection issue in the CrushFTP administrative interface. The "Who Created Folder" report reflects folder metadata into the admin UI without adequate output encoding. Attacker-controlled input persists in server-side state and renders inside privileged admin sessions on retrieval.

Exploitation requires low-privileged authentication and user interaction from an administrator viewing the report. The scope changes from the attacker's context to the administrator's browser session, allowing content injection that operates with administrative UI trust.

While the impact is limited to integrity of the rendered page, injected HTML in an admin console can facilitate credential harvesting through fake login prompts, redirect chains, and manipulation of administrator-visible content within the file transfer management platform.

Root Cause

The root cause is missing or insufficient output encoding of user-supplied folder creation metadata before it is embedded into the report HTML rendered by the Admin Panel. Input that should be treated as data is instead interpreted as markup by the administrator's browser.

Attack Vector

A low-privileged authenticated user creates folders or performs actions that populate fields tracked by the "Who Created Folder" report with HTML markup. When an administrator opens the Reports view, the injected markup renders inside the admin session. Refer to the proof-of-concept repository and the technical gist for the injection details.

No verified exploit code is republished here. The vulnerability mechanism is documented in the public references above.

Detection Methods for CVE-2025-63420

Indicators of Compromise

Folder names, usernames, or metadata fields in CrushFTP containing HTML tags such as <img>, <iframe>, <script>, or event handler attributes.
Unexpected outbound requests originating from administrator browsers immediately after viewing the Reports page.
Anomalous administrator session behavior following access to the "Who Created Folder" report.

Detection Strategies

Inspect CrushFTP audit logs for folder creation entries containing angle brackets or encoded HTML entities.
Review administrator browser telemetry for requests to unexpected external hosts triggered from the Admin Panel origin.
Compare deployed CrushFTP version against 11.3.7_57 to identify vulnerable instances.

Monitoring Recommendations

Enable and centralize CrushFTP administrative and file operation logs for review.
Alert on folder or user field values that contain HTML control characters.
Monitor administrator authentication events and follow-on API calls for deviations from baseline.

How to Mitigate CVE-2025-63420

Immediate Actions Required

Upgrade CrushFTP 11 to version 11.3.7_57 or later.
Audit existing folder metadata and user-controlled fields for previously injected HTML content and sanitize as required.
Restrict Admin Panel access to trusted networks and administrative workstations.

Patch Information

CrushFTP has addressed the issue in release 11.3.7_57. Upgrading to this version or a later release remediates the stored HTML injection in the "Who Created Folder" report. Review vendor release notes before deployment.

Workarounds

Limit low-privileged user permissions to create folders or modify tracked metadata until patched.
Avoid using the "Who Created Folder" report on unpatched instances.
Enforce a strict Content Security Policy at the reverse proxy in front of the Admin Panel to reduce the impact of injected markup.

bash

# Verify installed CrushFTP version and plan upgrade
grep -i version /opt/crushftp/CrushFTP.log | tail -n 5
# Target upgrade: CrushFTP 11.3.7_57 or later