Loading story…
A critical security vulnerability, tracked as CVE-2025-34299, was discovered in Monsta FTP versions 2.11 and earlier, allowing unauthenticated attackers to upload arbitrary files to affected servers. This flaw enables remote code execution (RCE) without requiring any authentication, as attackers can trick the application into downloading and saving malicious files from attacker-controlled (S)FTP servers directly onto the victim’s system. The vulnerability was identified by cybersecurity researchers at watchTowr, who confirmed that the exploit could be used to gain full control over targeted web servers running vulnerable versions of Monsta FTP.
Monsta FTP is widely used for web-based file management by organizations ranging from financial institutions to individual website owners, increasing the potential impact of this vulnerability. Security advisories emphasize the critical nature of the flaw, with a CVSS score of 9.3, and recommend immediate patching or mitigation to prevent exploitation. The vulnerability is pre-authentication, meaning attackers do not need valid credentials to exploit it, making unpatched systems especially susceptible to takeover and compromise.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
runZero published technical guidance on how defenders can find Monsta FTP installations on their networks. The post represented a defensive response to help organizations assess exposure to the vulnerable software.
Public reporting highlighted that the Monsta FTP vulnerability exposed thousands of web servers and could be leveraged for full server takeover. This marked broader awareness of the scale and impact of the flaw.
A high-severity vulnerability, CVE-2025-34299, was disclosed affecting Monsta FTP versions 2.11 and earlier. The issue allows unauthenticated arbitrary file upload, creating a path to possible server compromise.
3 references tracked. Mallory keeps watching after this page renders.
runzero.com
Open sourcehackread.com
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers disclosed multiple serious vulnerabilities in **Monsta FTP**, including `CVE-2025-34299` for remote code execution and `CVE-2026-60105`, a high-severity unauthenticated server-side request forgery flaw affecting versions through **2.14.4**. The SSRF issue stems from incomplete IP blocklist validation in the `fetchRemoteFile` feature, allowing attackers to use IPv4-mapped IPv6 addresses such as `::ffff:169.254.169.254` to bypass protections meant to block loopback, private-network, and cloud metadata targets. The SSRF bug lets an unauthenticated attacker obtain a CSRF token, force the server to make HTTP or HTTPS GET requests, and exfiltrate responses to an attacker-controlled FTP server, potentially exposing cloud instance metadata, internal services, and loopback-only resources. VulnCheck said **Monsta FTP 2.14.5** silently fixed the SSRF issue without a security advisory, while separate reporting highlighted the remote code execution risk, leaving organizations using Monsta FTP facing both internal network exposure and possible full server compromise.
Jul 14, 2026
A **critical CrushFTP zero-day**, tracked as `CVE-2025-54309`, has been reported as **actively exploited in the wild**, prompting urgent warnings from security researchers and national incident responders. The flaw affects **CrushFTP 11.x and 10.x** builds including **11.3.4_23 and later** and **10.8.5 and later**, and can allow attackers to **bypass authentication and obtain administrator access over HTTPS** when the **DMZ proxy service is disabled**. The issue has been assigned a **CVSS 3.1 score of 9.0** and has been linked to **improper AS2 validation** in vulnerable versions. CrushFTP released fixes in **11.3.4_26** and **10.8.5_12**, and defenders were urged to patch immediately or restore the application’s original configuration from **clean backups created on or before July 16** if patching is not yet possible. Reported indicators of compromise include changes to `MainUsers/default/user.xml` containing the string `last_logins`, creation of unknown administrator accounts with long identifiers, unusual UI behavior, administrator logins from unfamiliar IP addresses, and altered permissions on sensitive directories.
Jul 24, 2026
A critical **CrushFTP** zero-day was reported as actively exploited, allowing an unauthenticated attacker to escape the product’s virtual file system and download files from the underlying system. The flaw was discovered by Simon Garrelou of **Airbus CERT**, and public reporting said observed attacks primarily targeted organizations in the **United States**, with some suspicion that the activity was politically motivated. Defenders were urged to patch immediately because affected deployments could suffer sensitive information disclosure without valid credentials. Guidance pointed users running versions older than **11.1**—particularly **version 9**—to upgrade to fixed releases **10.7.1** or **11.1.0**, while CrushFTP’s update documentation provided the vendor’s release path for remediation.
Jul 24, 2026