CVE-2025-34299

🗓️ 07 Nov 2025 13:51:33Reported by VulnCheckType

cve🔗 web.nvd.nist.gov📰️ 5 Media mentions👁 49 Views🌐 WEB

Monsta FTP up to version 2.11 allows unauthenticated arbitrary file uploads enabling code execution.

Reporter	Title	Published	Views	Family All 18
GithubExploit	Exploit for CVE-2025-34299	19 Nov 202500:39	–	githubexploit
GithubExploit	Exploit for Unrestricted Upload of File with Dangerous Type in Monstaftp Monsta_Ftp	11 Dec 202503:42	–	githubexploit
Circl	CVE-2025-34299	7 Nov 202510:26	–	circl
CNNVD	Monsta FTP 代码问题漏洞	7 Nov 202500:00	–	cnnvd
Cvelist	CVE-2025-34299 Monsta FTP <= 2.11 Unauthenticated Arbitrary File Upload	7 Nov 202513:51	–	cvelist
EUVD	EUVD-2025-38247	7 Nov 202513:51	–	euvd
HackRead	Monsta FTP Vulnerability Exposed Thousands of Servers to Full Takeover	10 Nov 202510:53	–	hackread
Metasploit	Monsta FTP downloadFile Remote Code Execution	27 Nov 202518:57	–	metasploit
Nuclei	Monsta FTP <= 2.11.2 - Unauthenticated Remote Code Execution	31 Jul 202606:09	–	nuclei
NVD	CVE-2025-34299	7 Nov 202514:15	–	nvd

NVD

Vulners

CNA

Node

monstaftp monsta_ftpRange≤2.11

[
  {
    "defaultStatus": "unaffected",
    "product": "Monsta FTP",
    "vendor": "Monsta Limited of New Zealand",
    "versions": [
      {
        "lessThanOrEqual": "2.11",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
vulncheck	www.vulncheck.com/advisories/monsta-ftp-unauthenticated-arbitrary-file-upload
monstaftp	www.monstaftp.com/notes/
labs	www.labs.watchtowr.com/whats-that-coming-over-the-hill-monsta-ftp-remote-code-execution-cve-2025-34299/

Parameter	Position	Path	Description	CWE
request	request body	/application/api/api.php	Upload of a malicious PHP file via the API (unauthenticated file upload)	CWE-434
random_file	path	/application/api/{random_file}	Trigger execution of the uploaded PHP reverse shell	CWE-434

17 Jun 2026 09:13Current

7.5High risk

Vulners AI Score7.5

CVSS 3.19.8

CVSS 49.3

EPSS0.72667

SSVC