CVE-2025-34299

CriticalCVSS 9.8

Published: 07/11/2025(UTC)Updated: 18/10/2026(UTC)Translated: 19/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Very high risk

72.68%

99th percentile - higher than 99% of all known CVEs

Summary

Monsta FTP versions 2.11 and earlier contain a vulnerability allowing unauthenticated arbitrary file uploads. This flaw enables attackers to execute arbitrary code by uploading a specially crafted file from a malicious (S)FTP server.

Risk Assessment

An attacker can remotely execute code on the server without authentication, potentially leading to system compromise and further attacks.

Recommendation

Update Monsta FTP to a version later than 2.11 or apply access restrictions to the interface.

Other vulnerabilities in Monsta FTP

CVE-2026-60105High
Monsta FTP before version 2.14.5 contains a server-side request forgery (SSRF) vulnerability in the fetchRemoteFile action. The isBlockedIP() function fails to detect embedded IPv4 addresses within IPv4-mapped IPv6 addresses. An unauthenticated attacker can obtain a CSRF token from the public getSystemVars endpoint and submit a fetchRemoteFile request with a source URL resolving to an IPv4-mapped address, causing the server to issue HTTP requests to internal services and write responses to an attacker-controlled FTP destination, enabling retrieval of cloud instance metadata credentials.

Original NVD description (English source)

Monsta FTP versions 2.11 and earlier contain a vulnerability that allows unauthenticated arbitrary file uploads. This flaw enables attackers to execute arbitrary code by uploading a specially crafted file from a malicious (S)FTP server.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS