CVE-2025-34299
Published: 07 November 2025
Summary
CVE-2025-34299 is a critical-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability in Monstaftp Monsta Ftp. Its CVSS base score is 9.3 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 1.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 AC-20 (Use of External Systems) and SI-10 (Information Input Validation).
Deeper analysis
Monsta FTP versions 2.11 and earlier are affected by CVE-2025-34299, a vulnerability that enables unauthenticated arbitrary file uploads. This flaw, classified under CWE-434 (Unrestricted Upload of File with Dangerous Type), allows attackers to upload specially crafted files from a malicious SFTP server, ultimately leading to arbitrary code execution on the target system. The vulnerability carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity due to its network accessibility, lack of prerequisites, and potential for complete system compromise.
Unauthenticated remote attackers can exploit this vulnerability by tricking Monsta FTP into connecting to a controlled malicious SFTP server and downloading a malicious file. Once uploaded, the file enables arbitrary code execution with the privileges of the Monsta FTP process, potentially granting attackers full control over the server, including data exfiltration, persistence, or lateral movement within the environment.
Advisories from WatchTowr Labs, VulnCheck, and the Monsta FTP vendor notes provide further details on exploitation and mitigation strategies, including recommendations to upgrade to a patched version where available and to restrict SFTP connections to trusted endpoints.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-38247
Vulnerability details
Monsta FTP versions 2.11 and earlier contain a vulnerability that allows unauthenticated arbitrary file uploads. This flaw enables attackers to execute arbitrary code by uploading a specially crafted file from a malicious (S)FTP server.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unauthenticated remote arbitrary file upload leading to RCE in network-accessible Monsta FTP web application directly enables Exploit Public-Facing Application (T1190).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates the vulnerability by identifying, reporting, and correcting the arbitrary file upload flaw through timely patching as recommended by the vendor.
Prevents exploitation by restricting Monsta FTP connections to only approved and trusted external SFTP servers, blocking interactions with malicious servers.
Addresses CWE-434 unrestricted upload of dangerous file types by validating file inputs during SFTP transfers to reject specially crafted malicious files.