---
id: 9257
title: "CrushFTP Authentication Bypass - CVE-2025-2825"
source_domain: projectdiscovery.io
source_url: "https://projectdiscovery.io/blog/crushftp-authentication-bypass"
published_at: "2025-03-28T10:34:04Z"
tags: ["bug-bounty"]
phying_url: "https://phying.com/item/9257"
lang: en
---

# CrushFTP Authentication Bypass - CVE-2025-2825

## Summary

Update (April 21, 2025): The CVE originally referenced in this blog post CVE-2025-2825 has been rejected by NIST. The vulnerability is now officially tracked as CVE-2025-31161. All technical details and the impact discussed in this post remain accurate and apply to the updated CVE. This change is also reflected in the corresponding Nuclei template update. Enterprise file transfer solutions are critical infrastructure for many organizations, facilitating secure data exchange between systems and

## Intelligence Metadata

- **Sources:** projectdiscovery.io
- **Published:** 2025-03-28T10:34:04Z
- **Original:** https://projectdiscovery.io/blog/crushftp-authentication-bypass
- **Phying News:** https://phying.com/item/9257