# CVE-2025-63419: Cross Site Scripting (XSS) vulnerability in CrushFTP 11.3.6_48. The Web-Based Server has a feature where users can…

Source: https://junglewise.ai/threats/cve-2025-63419-cross-site-scripting-xss-vulnerability-in-crushftp-11-3-6-48-the  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-11-12  
License: CC BY 4.0 with a link back

CVE-2025-63419 · Severity: medium · CVSS 6.1 · Published 2025-11-12

Cross Site Scripting (XSS) vulnerability in CrushFTP 11.3.6_48. The Web-Based Server has a feature where users can share files, the feature reflects the filename to an emailbody field with no sanitations leading to HTML Injection.

Technologies: [CrushFTP](https://junglewise.ai/threats/technologies/crushftp). Vendors: [CrushFTP](https://junglewise.ai/threats/vendors/crushftp).

## Quick answers

**Is CVE-2025-63419 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-63419 being exploited in the wild.

**How severe is CVE-2025-63419?** Medium severity, with a CVSS score of 6.1, published 12 November 2025.

**Which products and versions are affected?** CrushFTP. The advisory does not name versions.

**Is there a fix for CVE-2025-63419?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**Am I affected by CVE-2025-63419?** Check whether you run CrushFTP. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Affected products

- CrushFTP

## Related threats

- [CrushFTP cross-site request forgery in web management interface](https://junglewise.ai/threats/cve-2015-20129-crushftp-before-7-3-0-contains-a-cross-site-request-forgery)
- [CrushFTP unprotected alternate channel in AS2 validation](https://junglewise.ai/threats/cve-2025-54309-crushftp-unprotected-alternate-channel-in-as2-validation)
- [CrushFTP Authentication Bypass Vulnerability](https://junglewise.ai/threats/cve-2025-31161-crushftp-authentication-bypass-vulnerability)
- [CrushFTP VFS Sandbox Escape Vulnerability](https://junglewise.ai/threats/cve-2024-4040-crushftp-vfs-sandbox-escape-vulnerability)