CVE-2025-34299
Monsta FTP <= 2.11 Unauthenticated Arbitrary File Upload
Description
Monsta FTP versions 2.11 and earlier contain a vulnerability that allows unauthenticated arbitrary file uploads. This flaw enables attackers to execute arbitrary code by uploading a specially crafted file from a malicious (S)FTP server.
INFO
Published Date :
Nov. 7, 2025, 2:15 p.m.
Last Modified :
Nov. 12, 2025, 4:20 p.m.
Remotely Exploit :
Yes !
Source :
[email protected]
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 4.0 | CRITICAL | 83251b91-4cc7-4094-a5c7-464a1b83ea10 | ||||
| CVSS 4.0 | CRITICAL | [email protected] |
Solution
- Update Monsta FTP to version 2.11 or later.
- Restrict file upload access.
- Monitor SFTP server connections.
Public PoC/Exploit Available at Github
CVE-2025-34299 has a 5 public
PoC/Exploit available at Github.
Go to the Public Exploits tab to see the list.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2025-34299.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2025-34299 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2025-34299
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
MonstaFTP Unauthenticated File Upload
Python Dockerfile
CVE-2025-34299
Detection for CVE-2025-34299
cve-2025-34299 nuclei zero-day
Monsta FTP Unauthenticated Arbitrary File Upload - Proof of Concept
cve-2025-34299
Python
📡 PoC auto collect from GitHub. ⚠️ Be careful Malware.
security cve exploit poc vulnerability
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2025-34299 vulnerability anywhere in the article.
-
security.nl
'Honderden kwetsbare Monsta FTP-clients toegankelijk vanaf internet'
Honderden Monsta FTP-clients die vanaf het internet toegankelijk zijn bevatten een kritieke kwetsbaarheid waardoor ongeauthenticeerde aanvallers op afstand code op systemen kunnen uitvoeren. Dat laat ... Read more
-
hackread.com
Monsta FTP Vulnerability Exposed Thousands of Servers to Full Takeover
A web-based file management application, Monsta FTP, was recently found to have a serious security problem that could allow hackers to completely take over a web server. Cybersecurity firm watchTowr d ... Read more
-
CybersecurityNews
Monsta web-based FTP Remote Code Execution Vulnerability Exploited
A critical remote code execution vulnerability in Monsta FTP, a popular web-based FTP client used by financial institutions and enterprises worldwide. The flaw, now tracked as CVE-2025-34299, affects ... Read more
The following table lists the changes that have been made to the
CVE-2025-34299 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
New CVE Received by [email protected]
Nov. 07, 2025
Action Type Old Value New Value Added Description Monsta FTP versions 2.11 and earlier contain a vulnerability that allows unauthenticated arbitrary file uploads. This flaw enables attackers to execute arbitrary code by uploading a specially crafted file from a malicious (S)FTP server. Added CVSS V4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Added CWE CWE-434 Added Reference https://labs.watchtowr.com/whats-that-coming-over-the-hill-monsta-ftp-remote-code-execution-cve-2025-34299/ Added Reference https://www.monstaftp.com/notes/ Added Reference https://www.vulncheck.com/advisories/monsta-ftp-unauthenticated-arbitrary-file-upload