CVE-2025-34299 is a critical unauthenticated arbitrary file upload flaw (CVSS 9.8) in Monsta FTP 2.11 and earlier. An attacker can reach code execution by having the application fetch a crafted file from a malicious (S)FTP server. The researchers report a fix in 2.11.3. Upgrade to the newest release.
What's affected
The record says Monsta FTP versions 2.11 and earlier are affected. The watchTowr write-up says the vendor released 2.11.3 on 26 August 2025, which remediates the vulnerability, and notes that the research was first done against an older 2.10.4 build before confirming the behavior on 2.11.
The Monsta FTP release notes page lists later versions, including a release described as an important security update on 10 October 2026. Take the newest release rather than stopping at 2.11.3.
The VulnCheck advisory states that this CVE is in the VulnCheck KEV database. That is a different list from the CISA catalog, which the record does not flag. VulnCheck's wording means you should treat exploitation as possible.
How to check if you're exposed
Monsta FTP is a web based file manager, so find every instance you run, including old copies on shared hosting. The version is shown in the application, and the release notes list what each version changed. Anything at 2.11 or earlier is in range. Go to the current version rather than relying on a specific intermediate build.
Then check exposure. Is the Monsta FTP page reachable from the internet? Look at your web server logs for unexpected writes in the application directory and for newly created script files you did not deploy. A fresh script file in a web directory is a strong sign of trouble.
If you track the software you run in an inventory or SBOM, the Gold directory entry and the free in-browser scan at gold.safeguard.sh/scan help you see which of your components carry this CVE. Appliance and server products are easy to miss, so add them to the list by hand if your scanner only reads package manifests.
What to do now
- Upgrade Monsta FTP to the newest version listed on the vendor release notes page. 2.11.3 is the first fixed release according to the researchers.
- If you cannot upgrade immediately, take the instance offline or restrict it to a VPN or an allow list of addresses.
- Search the web root for files you did not put there, especially executable script files, and compare against a known clean copy.
- Review which remote servers the application is allowed to connect to, and block outbound access to unknown hosts where you can.
- If you find signs of compromise, rotate every credential stored or used by the application and rebuild the host from a clean image.
Why it matters
The class is CWE-434 (Unrestricted Upload of File with Dangerous Type). A file that arrives from a remote server is saved without enough checks on its name and type, so the application ends up placing attacker controlled content where the web server can run it. The unusual part is the direction: the malicious content comes from an (S)FTP server that the application is tricked into talking to, so the attack does not need a login to Monsta FTP itself.
File managers sit in a risky spot. They are meant to move files around, and their code paths touch the file system by design. Monsta FTP also has a history of earlier vulnerabilities, which the researchers used as a starting point for their work. Keep these tools patched, and keep them off the public internet when you can.
Quick check
Is this exploited in the wild?
VulnCheck lists it in its own KEV database. The record does not show it in the CISA catalog. Treat exploitation as likely and patch quickly.
Which version fixes it?
The watchTowr timeline says 2.11.3 on 26 August 2025. Use the latest release on the vendor notes page.
Sources
Last reviewed: 18 October 2026.
