Vulnerability · Published Nov 7, 2025 · Assigned by VulnCheck

CVE-2025-34299Monsta FTP <= 2.11 Unauthenticated Arbitrary File Upload

Critical 9.3

In plain English

A critical-severity unrestricted file upload in Monsta FTP from Monsta Limited of New Zealand. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 72.7% (higher than 99.4% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, Nuclei, public proof-of-concept code.

Severity (CVSS 4.0)9.3Critical

Exploit odds (30 days)72.7%top 0.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling3Metasploit, Nuclei, Public PoC

Official description

Monsta FTP versions 2.11 and earlier contain a vulnerability that allows unauthenticated arbitrary file uploads. This flaw enables attackers to execute arbitrary code by uploading a specially crafted file from a malicious (S)FTP server.

Affected products (as reported)

Vendor	Product	Versions
Monsta Limited of New Zealand	Monsta FTP	0 – through 2.11

Weakness: CWE-434 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

https://www.monstaftp.com/notes/ release-notes, patch
https://labs.watchtowr.com/whats-that-coming-over-the-hill-monsta-ftp-remote-code-execution-cve-2025-34299/ technical-description, exploit
https://www.vulncheck.com/advisories/monsta-ftp-unauthenticated-arbitrary-file-upload third-party-advisory