CVE-2025-34299

What it actually does

Monsta FTP 2.11 and earlier allows an unauthenticated attacker to upload arbitrary files through vulnerable file-transfer functionality. If the uploaded file is placed in a web-accessible or executable location, a crafted server-side script such as a PHP web shell can be invoked remotely, resulting in arbitrary code execution in the context of the web server process. Successful exploitation can allow command execution, file modification, credential theft from application configuration files, lateral movement from the hosting server, and persistence through additional web-accessible backdoors.

Why it matters to the business

This is a critical remote code execution risk against internet-facing file-management software. Because exploitation is weaponized and the EPSS probability is high, exposed Monsta FTP instances should be treated as likely targets even though the issue is not currently listed in CISA KEV. A compromise could lead to stolen files and credentials, defaced or encrypted web content, deployment of malware, interruption of file-transfer services, and broader compromise of systems reachable from the web server.

How an attack unfolds

An attacker first identifies a publicly reachable Monsta FTP deployment running version 2.11 or earlier. The attacker then abuses the unauthenticated upload weakness, potentially by causing the application to retrieve or accept a specially crafted file from an attacker-controlled FTP or SFTP server. Instead of uploading only benign user files, the attacker places an executable script or web shell where the web server can serve and execute it. The attacker then sends an HTTP request to the uploaded script, which provides command execution under the web server account. From there, the attacker typically enumerates the host, reads Monsta FTP and web application configuration files, collects stored credentials or session material, uploads additional tooling, and may pivot to other services or use the host for persistence and staging.

How to fix it

Upgrade Monsta FTP to a version newer than 2.11 that contains the vendor fix, if available from the vendor. If an exact fixed version is not yet known or cannot be deployed immediately, remove Monsta FTP from internet exposure, restrict access to trusted IP addresses or VPN-authenticated users, disable unauthenticated upload or remote server import functionality where configurable, and ensure the web server cannot execute scripts from upload, temporary, cache, or user-writable directories. Harden the deployment by enforcing least-privilege file permissions, disabling PHP execution in writable directories, rotating any credentials stored or used by Monsta FTP, and reviewing the server for unexpected files before returning the service to production.

How to confirm the fix worked

Confirm the installed Monsta FTP version is newer than 2.11 or matches the vendor-designated fixed release. Attempt to access the upload/import functionality without authentication and verify it is rejected. Validate that uploaded files cannot be written to executable or web-accessible paths and that server-side scripts placed in writable directories are not executed by the web server. Review web server configuration for rules denying PHP, PHTML, PHAR, CGI, or other executable script handling in Monsta FTP upload, cache, and temporary directories. Perform an authenticated and unauthenticated web scan to verify the vulnerable behavior is no longer reachable, and review file integrity baselines to ensure no suspicious scripts remain from prior exposure.

Typical attack path

1. Scan for internet-exposed Monsta FTP installations and fingerprint the application version or vulnerable endpoints.
2. Confirm the target is running Monsta FTP 2.11 or earlier or otherwise exposes the vulnerable upload behavior.
3. Prepare a malicious file, commonly a server-side script or web shell, hosted locally or on an attacker-controlled FTP/SFTP server.
4. Trigger the vulnerable unauthenticated upload path so the malicious file is written to the Monsta FTP web root, upload area, cache, temporary directory, or another executable web-accessible path.
5. Request the uploaded file over HTTP/HTTPS to execute commands on the server.
6. Enumerate the host, application files, environment variables, and configuration files for credentials and sensitive data.
7. Establish persistence by deploying additional backdoors or scheduled tasks and remove obvious traces where possible.
8. Use harvested credentials or network access to move laterally, exfiltrate files, or stage additional malware.

How to detect it

Review web server access logs, Monsta FTP application logs, FTP/SFTP server logs, endpoint telemetry, file creation timestamps, and process execution records for evidence of unauthenticated uploads followed by execution of newly written files. Pay particular attention to POST requests to Monsta FTP paths, requests that reference attacker-controlled FTP or SFTP URLs, and subsequent GET requests to unusual PHP/PHTML/PHAR files in Monsta FTP or web root directories. On the host, search for recently created executable scripts in writable directories, web shells containing command-execution functions, unexpected child processes spawned by the web server user, and outbound connections from the web server process to unfamiliar infrastructure. Correlate suspicious file creation with access log entries from the same source IP. Because exploitation is weaponized, absence from KEV should not reduce hunting priority.

• /mftp/
• /monstaftp/
• POST /mftp/
• POST /monstaftp/
• ftp://
• sftp://
• *.php in Monsta FTP writable directories
• *.phtml in Monsta FTP writable directories
• *.phar in Monsta FTP writable directories
• *.cgi in Monsta FTP writable directories
• eval($_POST
• eval($_REQUEST
• assert($_POST
• assert($_REQUEST
• system($_GET
• system($_POST
• shell_exec($_GET
• shell_exec($_POST
• passthru($_GET
• passthru($_POST
• exec($_GET
• exec($_POST
• base64_decode($_POST
• base64_decode($_REQUEST
• php_uname()
• proc_open(
• popen(
• /bin/sh -c
• cmd.exe /c
• www-data spawning sh
• www-data spawning bash
• apache spawning sh
• apache spawning bash
• nginx spawning sh
• nginx spawning bash

What your security team should do

• Treat internet-facing Monsta FTP 2.11 and earlier as urgent due to critical severity, high EPSS, weaponized exploitation, and long public exposure time.
• Immediately inventory all Monsta FTP deployments, including embedded copies in web hosting panels, file-management portals, and developer tools.
• Patch to the vendor-fixed version as soon as available; if no fixed version is confirmed, isolate or disable the application until compensating controls are in place.
• Restrict Monsta FTP access behind VPN, identity-aware proxy, allowlisted source IPs, or administrative networks only.
• Block script execution in all writable Monsta FTP directories and ensure the web server user cannot write to application code directories.
• Hunt for suspicious recently created PHP, PHTML, PHAR, CGI, ASP, JSP, or shell files under Monsta FTP directories and web roots.
• Review HTTP access logs for unauthenticated upload attempts followed by requests to newly uploaded files.
• Rotate FTP, SFTP, SSH, database, API, and application credentials accessible from the Monsta FTP host or configuration files.
• If suspicious files or command execution artifacts are found, preserve evidence, isolate the host, perform full incident response, and rebuild from trusted media if compromise is confirmed.