Monsta FTP Remote Code Execution Flaw Being Exploited in the Wild

Security researchers have publicly flagged an actively exploited remote code execution vulnerability in Monsta FTP, tracked as CVE-2025-34299, affecting versions up to 2.11.2 and allowing attackers to run arbitrary code on vulnerable servers without authentication. The flaw was fixed with the release of version 2.11.3 on 26 August 2025, and the CVE was officially assigned on 4 November 2025.

According to the report, exploitation targets Monsta FTP’s downloadFile function by sending a crafted HTTP request that makes the application connect to a malicious external SFTP server, download a payload, and write it to a web-accessible location, enabling code execution. The attackers can then compromise the system, with no authentication required and a single POST request sufficient in some cases.

WatchTowr Labs researchers traced the issue to earlier vulnerabilities in version 2.10.3 that were not adequately fixed in subsequent releases, despite new input validation in 2.11. The article urges upgrading to 2.11.3 or later and conducting thorough security reviews of web-based file management tools.