CVE-2025-34299

Monsta FTP versions 2.11 and earlier contain an unauthenticated arbitrary file upload flaw (CWE-434) that can be triggered remotely without any credentials or user interaction. An attacker can cause a specially crafted file to be uploaded from a malicious (S)FTP server that the Monsta FTP instance connects to, and the crafted upload ultimately allows execution of arbitrary code on the server hosting the web FTP client. Successful exploitation gives the attacker code execution with the privileges of the web application, which on typical shared hosting deployments can lead to compromise of hosted sites and stored credentials. Anyone running a self-hosted Monsta FTP instance at version 2.11 or earlier is affected, including instances embedded in hosting environments. A public proof-of-concept and technical write-up have been published by watchTowr Labs, the flaw is not yet listed in CISA KEV, and EPSS assigns a high 72.9% probability of exploitation within 30 days, indicating elevated near-term risk.

What to do: Upgrade Monsta FTP to the latest release newer than 2.11 as soon as a vendor-patched build is available, since the data does not specify a fixed version number. Until patched, restrict access to Monsta FTP (IP allow-listing, VPN, or an additional HTTP authentication layer in front of the application) and avoid connecting to untrusted (S)FTP servers. Review web server logs for unexpected or unauthenticated file writes/uploads and monitor watchTowr and vendor advisories for confirmation of in-the-wild exploitation.