---
id: CVE-2015-20129
title: CrushFTP before 7.3.0 Cross-Site Request Forgery via /WebInterface/function/
summary: >-
  CrushFTP before 7.3.0 contains a cross-site request forgery vulnerability that
  allows attackers to perform administrative actions because CSRF protection is
  disabled by default. Attackers can lure an authenticated administrator to a
  mali…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-352
vendor: CrushFTP
product: CrushFTP
affected:
  - CrushFTP < 7.3.0
published: '2026-10-28'
updated: '2026-10-28'
sourceUpdated: '2026-10-28T02:03:14.501Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2015-20129'
references:
  - url: 'https://www.exploit-db.com/exploits/36126'
    label: 'ExploitDB-36126: CrushFTP 7.2.0 Multiple Vulnerabilities'
  - url: 'https://www.crushftp.com/version7.html'
    label: CrushFTP 7 Release Notes
  - url: >-
      https://www.vulncheck.com/advisories/crushftp-before-7.3.0-cross-site-request-forgery-via-webinterface-function
    label: >-
      VulnCheck Advisory: CrushFTP before 7.3.0 Cross-Site Request Forgery via
      /WebInterface/function/
tags:
  - cve.org
ingestedAt: '2026-10-28T03:02:57.632Z'
---

## Overview

CrushFTP before 7.3.0 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions because CSRF protection is disabled by default. Attackers can lure an authenticated administrator to a malicious page that submits POST requests to commands like setUserItem, creating root-access users or changing server configuration.

## Affected

- `CrushFTP < 7.3.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.