CVE-2025-34299: Monstaftp Monsta FTP

Critical severity, CVSS 9.8. EPSS: 72.7% chance of exploitation in the next 30 days.

Monsta FTP versions 2.11 and earlier contain a vulnerability that allows unauthenticated arbitrary file uploads. This flaw enables attackers to execute arbitrary code by uploading a specially crafted file from a malicious (S)FTP server.

Affected products

• Monstaftp Monsta FTP: up to and including 2.11

Published 2025-11-07. Last modified 2026-06-17.