- Description
- Monsta FTP versions 2.11 and earlier contain a vulnerability that allows unauthenticated arbitrary file uploads. This flaw enables attackers to execute arbitrary code by uploading a specially crafted file from a malicious (S)FTP server.
- Source
- disclosure@vulncheck.com
- NVD status
- Analyzed
- Products
- monsta_ftp
CVSS 4.0
- Type
- Secondary
- Base score
- 9.3
- Impact score
- -
- Exploitability score
- -
- Vector string
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- Severity
- CRITICAL
CVSS 3.1
- Type
- Primary
- Base score
- 9.8
- Impact score
- 5.9
- Exploitability score
- 3.9
- Vector string
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Severity
- CRITICAL
- disclosure@vulncheck.com
- CWE-434
- Hype score
- Not currently trending
What’s That Coming Over The Hill? (Monsta FTP Remote Code Execution CVE-2025-34299) #MonstaFTP #RemoteCodeExecution #ZeroDay #CVE202534299 #VulnerabilityDiscovery https://t.co/Nj9bTdrBgc
@reverseame
6 Mar 2026
561 Impressions
1 Retweet
1 Like
3 Bookmarks
0 Replies
0 Quotes
CVE-2025-34299 - Monsta FTP vulnerability https://t.co/Zn3qwTbkm0 https://t.co/DuQSuBfipn
@CloudVirtues
29 Dec 2025
56 Impressions
0 Retweets
1 Like
0 Bookmarks
0 Replies
0 Quotes
🚨 CVE-2025-34299 - critical 🚨 Monsta FTP <= 2.11.2 - Unauthenticated Remote Code Execution > Monsta FTP = 2.11 contains an unrestricted file upload vulnerability caused by lack o... 👾 https://t.co/fs3o1UKjzU @pdnuclei #NucleiTemplates #cve
@pdnuclei_bot
11 Dec 2025
204 Impressions
0 Retweets
1 Like
1 Bookmark
0 Replies
0 Quotes
CVE-2025-34299 - Monsta FTP vulnerability https://t.co/Meu0ZROd8a https://t.co/iuPUeCmVDb
@SirajD_Official
6 Dec 2025
36 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
CVE-2025-34299 - Monsta FTP vulnerability https://t.co/RNINrDtuvu https://t.co/GbgDqZCRU2
@IdentityJason
4 Dec 2025
45 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
🛡️ New WAF update! We're now blocking critical remote code execution attempts targeting Monsta FTP (CVE-2025-34299) & boosting XSS detection coverage. Keep your sites secure! 🚀 https://t.co/A32igNjSuI
@mveracf
3 Dec 2025
25 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
CVE-2025-34299 - Monsta FTP vulnerability https://t.co/XvmM8SQSEt https://t.co/Svcvuu6uQR
@PhotoZel
2 Dec 2025
46 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
Cloudflare has released new WAF rule addressing the following CVE to enhance customer protection. Monsta FTP - Remote Code Execution (CVE-2025-34299) https://t.co/OJymnEevsB
@Cloudforce_One
1 Dec 2025
3839 Impressions
5 Retweets
18 Likes
4 Bookmarks
0 Replies
0 Quotes
We have been sharing Monsta FTP CVE-2025-34299 (pre-auth RCE) vulnerable instances for the last few weeks. Unfortunately, we still see over 780 IPs vulnerable (version based check) instances daily. Most affected: US & Slovakia: https://t.co/x3mSy6MqZt https://t.co/pzy4zLibd
@Shadowserver
24 Nov 2025
1913 Impressions
7 Retweets
15 Likes
2 Bookmarks
1 Reply
0 Quotes
A Python exploit has been released for a critical Monsta FTP RCE flaw (CVE-2025-34299). The bug allows arbitrary PHP code execution by exploiting the downloadFile function. https://t.co/NX4hV39ou2 https://t.co/zaeB2Kkgt2
@the_yellow_fall
19 Nov 2025
318 Impressions
0 Retweets
4 Likes
1 Bookmark
0 Replies
0 Quotes
What’s That Coming Over The Hill? (Monsta FTP Remote Code Execution CVE-2025-34299) - watchTowr Labs https://t.co/De0i8l69Vb
@_r_netsec
15 Nov 2025
587 Impressions
0 Retweets
0 Likes
1 Bookmark
0 Replies
0 Quotes
🔥 Warning CVE-2025-34299: Unauthenticated File Upload Vulnerability in Monsta FTP 🌐️Exposed #Monsta FTP favicon in Criminal IP: Query ➡️ favicon: -64a5a63 https://t.co/NXViPNQ2tp Key risk of CVE-2025-34299: -Unauthorized Code Execution -Data
@CriminalIP_US
14 Nov 2025
113 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
🚨Monsta FTP リモートコード実行脆弱性（CVE-2025-34299, CVSS 9.3）警告 Web ベースの FTP クライアント Monsta FTP v2.11 未満にて、認証不要の攻撃者が悪意ある (S)FTP サーバーを介して 任意ファイルをアップロード →
@CriminalIP_JP
14 Nov 2025
92 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
🚨 Monsta FTP 원격 코드 실행 취약점(CVE-2025-34299) 경고 웹 기반 FTP 클라이언트 Monsta FTP v2.11 미만에서 인증 없이 임의 파일 업로드 → 서버 측 RCE가 가능한 치명적 취약점이 공개되었습니다. 🔎 Criminal IP 검색 쿼리:
@CriminalIP_KR
14 Nov 2025
44 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
Monsta FTP Vulnerability Exposed Thousands of Servers to Full Takeover (CVE-2025-34299) https://t.co/JLyvueozmo #patchmanagement
@eyalestrin
13 Nov 2025
14 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
🚨🚨CVE-2025-34299 (CVSS 9.3) — Monsta FTP: unauthenticated arbitrary file upload leading to remote code execution via a crafted file from a malicious (S)FTP server. Search by vul.cve Filter👉vul.cve="CVE-2025-34299" ZoomEye Dork👉app="Monsta FTP" 517 results found. Zo
@zoomeye_team
12 Nov 2025
1679 Impressions
8 Retweets
29 Likes
4 Bookmarks
0 Replies
0 Quotes
CVE-2025-34299: Monsta FTP vulnerable a ejecución remota https://t.co/Z7Yj4Sxlig #Internet #Noticia #CiberSeguridad #Tecnología vía @unaaldia https://t.co/0dBxpeUVAK
@Securizame
11 Nov 2025
281 Impressions
2 Retweets
5 Likes
1 Bookmark
0 Replies
0 Quotes
برای برنامه Monsta که web-based FTP client می باشد ، آسیب پذیری با کد شناسایی CVE-2025-34299 و از نوع RCE منتشر شده است . برای امن سازی به نسخه v2.11.3 به روز رسانی نمایید. https://t.co/02kg
@EthicalSafe
10 Nov 2025
33 Impressions
0 Retweets
1 Like
0 Bookmarks
0 Replies
0 Quotes
🚨 CVE-2025-34299: Monsta FTP Remote Code Execution A critical path traversal flaw in Monsta FTP lets attackers execute code without authentication. https://t.co/SFuulK7N8G #CyberSecurity #AppSec #Infosec #WebSecurity #ITSecurity #BugBounty #Hacking
@pentestnews
10 Nov 2025
2 Impressions
0 Retweets
1 Like
0 Bookmarks
0 Replies
0 Quotes
What’s That Coming Over The Hill? (Monsta FTP Remote Code Execution CVE-2025-34299) - watchTowr Labs https://t.co/De0i8l69Vb
@_r_netsec
9 Nov 2025
366 Impressions
0 Retweets
0 Likes
1 Bookmark
0 Replies
0 Quotes
What’s That Coming Over The Hill? (Monsta FTP Remote Code Execution CVE-2025-34299) - watchTowr Labs https://t.co/De0i8l69Vb
@_r_netsec
8 Nov 2025
757 Impressions
0 Retweets
0 Likes
3 Bookmarks
0 Replies
0 Quotes
🚨 New plugin: MonstaFtpVersionPlugin (CVE-2025-34299). MonstaFTP RCE vulnerability detection - versions < 2.11.3 affected. Results: https://t.co/cnbvDGldd8 https://t.co/LTLBBsolZd
@leak_ix
7 Nov 2025
984 Impressions
3 Retweets
7 Likes
2 Bookmarks
0 Replies
0 Quotes
What’s That Coming Over The Hill? (Monsta FTP Remote Code Execution CVE-2025-34299) - watchTowr Labs https://t.co/wsuinzg8Jm https://t.co/UjPWCE0Iir
@secharvesterx
7 Nov 2025
57 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
CVE-2025-34299 Monsta FTP versions 2.11 and earlier contain a vulnerability that allows unauthenticated arbitrary file uploads. This flaw enables attackers to execute arbitrary code… https://t.co/pHmiDqb7FC
@CVEnew
7 Nov 2025
18 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
csirt_it: ‼ #MonstaFTP: disponibile un #PoC per lo sfruttamento della CVE-2025-34299 Rischio: 🟠 Tipologia: 🔸 Remote Code Execution 🔗 https://t.co/5SYTP8xjry ⚠ Importante mantenere aggiornati i sistemi https://t.co/LA0EiKvKvP
@Vulcanux_
7 Nov 2025
59 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
[
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:monstaftp:monsta_ftp:*:*:*:*:*:*:*:*",
"matchCriteriaId": "818BD57D-CE20-4387-9801-1998AB0A43DE",
"versionEndIncluding": "2.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
]