CVE-2025-34299

CriticalPublic PoC

Published: 07 November 2025

Published

07 November 2025

Modified

10 December 2025

KEV Added

—

Patch

—

CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.6960 98.7th percentile

Risk Priority 61 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-34299 is a critical-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability in Monstaftp Monsta Ftp. Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 1.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 AC-20 (Use of External Systems) and SI-10 (Information Input Validation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190). What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match

prevent

Directly mitigates the vulnerability by identifying, reporting, and correcting the arbitrary file upload flaw through timely patching as recommended by the vendor.

AC-20 Use of External Systems good match

prevent

Prevents exploitation by restricting Monsta FTP connections to only approved and trusted external SFTP servers, blocking interactions with malicious servers.

SI-10 Information Input Validation good match

prevent

Addresses CWE-434 unrestricted upload of dangerous file types by validating file inputs during SFTP transfers to reject specially crafted malicious files.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

Why these techniques?

Unauthenticated remote arbitrary file upload leading to RCE in network-accessible Monsta FTP web application directly enables Exploit Public-Facing Application (T1190).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

NVD Description

Monsta FTP versions 2.11 and earlier contain a vulnerability that allows unauthenticated arbitrary file uploads. This flaw enables attackers to execute arbitrary code by uploading a specially crafted file from a malicious (S)FTP server.

Deeper analysisAI

Monsta FTP versions 2.11 and earlier are affected by CVE-2025-34299, a vulnerability that enables unauthenticated arbitrary file uploads. This flaw, classified under CWE-434 (Unrestricted Upload of File with Dangerous Type), allows attackers to upload specially crafted files from a malicious SFTP server, ultimately leading to arbitrary code execution on the target system. The vulnerability carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity due to its network accessibility, lack of prerequisites, and potential for complete system compromise.

Unauthenticated remote attackers can exploit this vulnerability by tricking Monsta FTP into connecting to a controlled malicious SFTP server and downloading a malicious file. Once uploaded, the file enables arbitrary code execution with the privileges of the Monsta FTP process, potentially granting attackers full control over the server, including data exfiltration, persistence, or lateral movement within the environment.

Advisories from WatchTowr Labs, VulnCheck, and the Monsta FTP vendor notes provide further details on exploitation and mitigation strategies, including recommendations to upgrade to a patched version where available and to restrict SFTP connections to trusted endpoints.