- CVE-2025-34299 allows remote code execution without authentication on Monsta FTP by downloading and arbitrarily writing files from a malicious (S)FTP server.
- The vulnerability affects all versions prior to 2.11.3 and is related to historical failures of insufficient path validation and file uploads.
- The effective fix comes with Monsta FTP 2.11.3, but it is essential to complement the patch with network segmentation, API access restriction, and outgoing connection monitoring.
The CVE-2025-34299 vulnerability in Monsta FTP has become one of the most serious flaws in recent times for web-based file management applications. This unauthenticated remote code execution flaw allows an attacker to take complete control of the server where Monsta FTP is installed, simply by forcing a connection to a malicious (S)FTP server and exploiting insufficient path and file validation.
This problem is not an isolated case: it links to a previous history of vulnerabilities in Monsta FTP (SSRF, arbitrary uploads, partial validations) and a somewhat confusing patch management system, where validation mechanisms were introduced that gave a false sense of security but did not address the root cause of the flaw. All of this has resulted in a critical CVE with a CVSS score of 9.3 that is already being exploited in real-world environments and affects thousands of instances on the internet.
What is Monsta FTP and why does this vulnerability matter?
Monsta FTP is a web-based FTP and SFTP client , developed in PHP and JavaScript, that is installed directly on a web server to manage files through a web browser, instead of using a traditional desktop client. This approach makes it especially convenient for administrators and developers who want to upload, download, and modify files from anywhere without additional software.
The problem is that these types of tools, being exposed to the internet, become a very attractive target for attackers . Monsta FTP has a considerable installed base, with a presence in financial institutions, businesses, and advanced users who use it to centrally manage their websites and servers.
Furthermore, the default installation path is usually /mftp/ , which in practice "hides" many installations from more generic scans, but does not at all prevent an attacker who detects the technology from trying to exploit known vulnerabilities.
In this context, a flaw that allows a remote and anonymous attacker to upload arbitrary files and execute them on the server, as is the case with CVE-2025-34299 , is especially serious: the application goes from being a simple file management tool to a direct vector of total system compromise.
Technical description of CVE-2025-34299: origin and nature of the fault
The vulnerability CVE-2025-34299 has been documented in detail by researchers at watchTown Labs, who describe it as an arbitrary file upload flaw with remote code execution in Monsta FTP. The flaw affects all versions prior to 2.11.3 and allows an unauthenticated remote attacker to have Monsta FTP download a file of their control from an (S)FTP server and save it to an arbitrary path on the web server, where it can then be executed.
In initial versions (up to 2.11), the problem was related to the insecure handling of parameters and the lack of robust validation of paths and files . Similar vulnerabilities had already been reported, such as CVE-2022-27468 (arbitrary file upload) and CVE-2022-31827 (SSRF), which highlighted that part of the file download and copy flow was not adequately protected.
The researchers identified that, although a validation module ( inputValidator.php ) was later introduced with numerous functions to detect directory traversal, absolute paths, null bytes, and suspicious patterns , these defenses were not properly applied to the flow that actually allowed insecure file writing. In other words, the attack surface remained open even with all those filters in place.
The practical result is that, in Monsta FTP up to version 2.11.2, an attacker could force the download of a file from a controlled SFTP server and order it to be saved in a directory accessible from the web, thus achieving code execution with the permissions of the web server process , usually www-data or another similar user.
How to exploit the vulnerability in the Monsta FTP API
The core of the vulnerability lies in the endpoint /mftp/application/api/api.php , which acts as the central point for the application's actions. This endpoint receives a parameter called `request` in the HTTP request body, which contains structured JSON with all the data necessary to establish the (S)FTP connection and perform actions on files.
Within that JSON file, aspects such as the connection type ( connectionType = "sftp"), the remote server configuration ( configuration : host, port, username, password, home directory), and the name of the action to execute ( actionName ), such as downloadFile , uploadFile, or fetchRemoteFile , are specified. Additional parameters, including the local and remote paths, are included in the context section.
The application includes a dispatch function that, through a switch statement , decides what to do based on actionName. This is where the validation logic of the InputValidator module comes into play , checking parameters such as remotePath or localPath for certain actions, attempting to prevent directory traversals or dangerous paths.
However, the researchers observed that, in the specific case of the downloadFile action , the actual implementation relied on a code flow where the local path to which the remote file was copied remained controllable by the attacker via the localPath parameter . This value ended up being used directly in the copy() call without any effective restriction on which directories could be written to.
In practice, this means an attacker can construct an HTTP POST request to /mftp/application/api/api.php instructing Monsta FTP to connect to a malicious SFTP server, download a file (for example, shell.php ), and store it in an arbitrary location on the web server, such as /var/www/html/mftp/index3.php . Then, a simple GET request to the newly created file is all it takes to execute malicious PHP code with server-side privileges.
Comparison with previous vulnerabilities and patching failures
The CVE-2025-34299 vulnerability didn't emerge out of nowhere: Monsta FTP already had a history of vulnerabilities related to the insecure handling of user input and file paths. Versions like 2.10.3 and 2.10.4 had already been affected by CVE-2022-31827 and CVE-2022-27468, which involved both SSRF and arbitrary file uploads.
WatchTower's detailed investigation showed that there were hardly any relevant changes to the code between versions 2.10.3 and 2.10.4, despite the existence of documented CVEs. In other words, later versions remained essentially vulnerable to the same problems , and the patches did not structurally address the logic that allowed dangerous file writing.
With the release of version 2.11 , Monsta FTP introduced the inputValidator.php module , which added very comprehensive validation features: detection of strings like "../", hardcoded variants (%2f, %5c, etc.), absolute paths, maximum path length, and other suspicious patterns. At first glance, it appeared to be a thorough code cleanup aimed at strengthening security.
However, when the researchers re-ran the SSRF proof-of-concept and uploaded files, they found that the attacks still worked even in version 2.11. In other words, a validation "wrap" layer had been applied around many entry points, but the specific flow that made arbitrary writing possible had not been cut off.
This pattern illustrates a common problem in many projects: implementing general validation layers without thoroughly reviewing critical code paths that lead to dangerous operations such as opening, writing, or copying files on the server. The result is a false sense of security for both developers and administrators, while the core vulnerability remains open.
Exploitation without credentials and scope of impact
One of the most concerning features of CVE-2025-34299 is that the exploit is entirely pre-auth , meaning no valid credentials or prior session in the Monsta FTP panel are required. The attacker only needs the Monsta FTP instance to be accessible from the internet and for the /mftp/application/api/api.php API to accept the malicious request.
By gaining the ability to execute code with web server permissions, an attacker can install backdoors , deploy webshells, read or modify application files, and even pivot to other systems on the internal network if the architecture is not properly segmented. In enterprise or financial environments, this can lead to theft of sensitive data, fraud, or serious service disruptions.
The scale of the impact is amplified by the significant adoption of Monsta FTP , with several thousand instances accessible on the internet, according to researchers' estimates. Many of these don't even appear in generic scans due to the default /mftp/ context , making it difficult for organizations to know if they actually have this vulnerability exposed and, if so, which version.
Another critical point is that the vulnerability can be exploited from anywhere in the world, provided the web server is accessible and a connection to the malicious SFTP server is possible at the network level. If there are no firewall rules restricting outbound connections from the server to the internet, exploitation becomes extremely trivial.
In this scenario, attackers can automate scans and exploitation on vulnerable Monsta FTP, integrating it into their mass attack campaigns , both for ransomware and for installing botnets or stealing credentials.
Affected versions, timeline, and available patch
The vulnerability CVE-2025-34299 affects all versions of Monsta FTP prior to 2.11.3 . This includes branches in which other CVEs had already been registered (2.10.3, 2.10.4, 2.11, 2.11.1, 2.11.2) and which continued to carry the problem in the internal logic of downloading and copying files.
The known chronology of the discovery and patching process is, broadly speaking, as follows, according to watchTown's research:
- August 13th, 2025: watchTowr reports the vulnerability (referred to as WT-2025-0091) to the Monsta FTP development team.
- August 14th, 2025The Monsta FTP team acknowledges receipt of the report and commits to reviewing the issue.
- August 15th, 2025: watchTowr initiates a broader analysis of its customers' attack surface in search of vulnerable instances of Monsta FTP.
- August 26th, 2025The version is published 2.11.3 from Monsta FTP, who finally effectively corrects the vulnerability addressing the insecure writing flow.
- November 4th 2025The identifier is officially assigned. CVE-2025-34299 to this vulnerability.
- November 6th 2025WatchTower publishes its detailed technical investigation into the failure.
Starting with version 2.11.3 , the code introduces additional controls that restrict write paths to allowed directories and strengthens parameter validation, preventing localPath from being used arbitrarily to write to system locations that may be served by the web server.
The general consensus among analysts and security vendors is clear: any organization still running versions prior to 2.11.3 should upgrade immediately or, if they cannot, disable public access to Monsta FTP while planning the migration.
How to identify vulnerable instances of Monsta FTP
Locating all instances of Monsta FTP within an organization isn't always straightforward, especially when there are old or forgotten servers where the tool was installed years ago and never checked again. This is where attack surface management and asset discovery solutions come into play.
Tools like runZero have published specific queries to help identify potential vulnerabilities based on features such as the application's favicon. An example of a suggested query is:
_asset.protocol:http AND protocol:http AND favicon.ico.image.mmh3:="1535999103"
This query identifies HTTP services whose favicon matches that of Monsta FTP, providing an initial list of systems that warrant a detailed version and configuration review . From there, it is essential to manually validate the installed version and verify whether patch 2.11.3 or later has been applied.
In addition to these types of searches, it is advisable to perform internal inventories (for example, with scripts or scanning tools) that look for the /mftp/ path on web servers and review the application files, since some installations may not follow the standard configuration of ports or domains.
Mitigation measures and good defense practices
While the fundamental step to mitigate CVE-2025-34299 is to update Monsta FTP to version 2.11.3 or later , simply applying the patch and forgetting about it is a bad idea. This incident makes it clear that additional layers of security are needed around applications of this type.
First, it is highly recommended to restrict access to the Monsta FTP API. The endpoint /mftp/application/api/api.php should not be openly accessible from any IP address on the internet. Ideally, traffic should be filtered through firewalls or access control lists, allowing only specific ranges (for example, the corporate VPN network) or even restricting its use to an intranet; a common option on Linux servers is to use iptables for this filtering.
Secondly, proper network segmentation must be implemented . Web servers hosting applications like Monsta FTP should not have unrestricted direct access to critical systems (core databases, ERPs, financial systems, etc.). With good segmentation and an understanding of the TCP/IP model , even if the web server is compromised, the attacker will have much more difficulty moving laterally.
Another essential measure is to monitor for anomalous outbound connections , especially those related to SFTP, FTP, or SSH to unusual external destinations. Exploiting this vulnerability requires the vulnerable server to connect to an (S)FTP server controlled by the attacker, so a well-configured monitoring system or SIEM should be able to raise alerts when it detects this type of suspicious traffic.
Finally, it is recommended to deploy and properly configure a web application firewall (WAF) and apply server hardening policies: reduce write permissions, ensure that the web server process runs with the lowest possible privileges , and perform regular vulnerability scans to detect old instances or versions that have fallen behind in the update cycle.
Zero trust, continuous monitoring, and context of other vulnerabilities
The Monsta FTP case and CVE-2025-34299 perfectly illustrate why zero-trust security approaches are increasingly necessary. The idea that an internet-facing application can be considered trustworthy simply because it is "up-to-date" is naive when exploitation flows focus on very specific implementation details.
Adopting a zero-trust approach involves continuously validating and monitoring every access point, every connection, and every configuration change, rather than assuming that once configured and patched, a service will never cause problems again. In the case of Monsta FTP, this means not only updating but also regularly reviewing logs , network behavior, file integrity, and the appearance of new suspicious files (shells, unknown scripts, etc.).
Furthermore, this incident is not an isolated case: other widely deployed products, such as web browsers, also regularly suffer critical vulnerabilities. A recent example outside the Monsta FTP world is the CVE-2024-11395 vulnerability in Google Chrome, a type confusion flaw in the V8 engine that could allow arbitrary code execution via specially crafted HTML pages.
In the case of Chrome, Google released a stable update (versions 131.0.6778.85/.86 on Windows and Mac, and 131.0.6778.85 on Linux) to fix three vulnerabilities, including this high-severity one. The recommendations were clear: update immediately , enable automatic updates, and avoid websites from dubious sources. The parallel with Monsta FTP is evident: a widely used product, a serious flaw, the need for an immediate patch, and yet a significant percentage of systems take time to catch up.
All of this reinforces the idea that security is not a one-off event, but a continuous process of exposure management , as is the case with platforms focused on the proactive management of external threats and attack surfaces. Integrating these types of tools and practices into daily operations allows for gaining something as valuable as reaction time to new vulnerabilities.
The CVE-2025-34299 vulnerability in Monsta FTP, its relationship to previous flaws, the long road to a truly effective patch, and the need to complement updates with network controls, WAF, segmentation, and a zero-trust approach, paint a picture in which organizations that adopt a proactive defense posture will have many more options to prevent a simple FTP web client from becoming the gateway to a serious incident.
