#CVE-2025-31161

Analysis · May 6, 2026 · The Field Notes Desk

CrushFTP chose the narrative over its customers

CrushFTP tried to keep a CVSS 9.8 auth bypass quiet. The disclosure mess that followed — two CVEs, public PoC code, CEO threats — helped attackers move faster.