Critical · published November 7, 2025
CVSS calls it critical at 9.8. It sits in the 99.4th percentile for exploit probability.
🚨 Unauthenticated arbitrary file uploads? Yup, that's the critical flaw lurking in Monsta FTP versions 2.11 and earlier! 🔥 Think of it like a restaurant where anyone can drop off any dish in the kitchen without any checks — a recipe for disaster! If someone served up a hidden poison, you'd be in big trouble. With this vulnerability, an attacker could upload malicious files that execute arbitrary code on your server. This could lead to unauthorized access, data breaches, or the complete takeover of your system — an absolutely devastating scenario that puts your sensitive data and the integrity of your service at grave risk!
Think of it like a restaurant where anyone can drop off any dish in the kitchen without any checks — a recipe for disaster! If someone served up a hidden poison, you'd be in big trouble. This flaw in Monsta FTP allows unauthenticated users to upload crafted files from a malicious SFTP server, leading to unauthorized code execution. Essentially, the server fails to validate the authenticity of incoming files, creating an open door for attackers.
With this vulnerability, an attacker could upload malicious files that execute arbitrary code on your server. This could lead to unauthorized access, data breaches, or the complete takeover of your system — an absolutely devastating scenario that puts your sensitive data and the integrity of your service at grave risk! To protect yourself, immediately patch to the latest version of Monsta FTP, as versions beyond 2.11 have been secured. Additionally, implement strict file validation checks to ensure only safe and intended files are uploaded. Don’t forget to audit your server’s configurations as well! You’ve got this! Take these steps to secure your system and keep the bad guys at bay! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| monstaftp/monsta_ftp | ≤ 2.11 | — |