Loading story…
Researchers disclosed multiple serious vulnerabilities in Monsta FTP, including CVE-2025-34299 for remote code execution and CVE-2026-60105, a high-severity unauthenticated server-side request forgery flaw affecting versions through 2.14.4. The SSRF issue stems from incomplete IP blocklist validation in the fetchRemoteFile feature, allowing attackers to use IPv4-mapped IPv6 addresses such as ::ffff:169.254.169.254 to bypass protections meant to block loopback, private-network, and cloud metadata targets.
The SSRF bug lets an unauthenticated attacker obtain a CSRF token, force the server to make HTTP or HTTPS GET requests, and exfiltrate responses to an attacker-controlled FTP server, potentially exposing cloud instance metadata, internal services, and loopback-only resources. VulnCheck said Monsta FTP 2.14.5 silently fixed the SSRF issue without a security advisory, while separate reporting highlighted the remote code execution risk, leaving organizations using Monsta FTP facing both internal network exposure and possible full server compromise.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
VulnCheck disclosed CVE-2026-60105, a high-severity unauthenticated SSRF vulnerability in Monsta FTP that can be exploited using IPv4-mapped IPv6 addresses to bypass protections and reach internal or cloud metadata endpoints.
According to VulnCheck, Monsta FTP version 2.14.5 fixed an unauthenticated SSRF issue caused by incomplete IP blocklist validation in the fetchRemoteFile feature, but did so without a security advisory. The flaw affected Monsta FTP through version 2.14.4.
watchTowr Labs published research on a remote code execution vulnerability in Monsta FTP tracked as CVE-2025-34299.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
chocapikk.com
Open sourcevulncheck.com
Open sourcelabs.watchtowr.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical security vulnerability, tracked as CVE-2025-34299, was discovered in Monsta FTP versions 2.11 and earlier, allowing unauthenticated attackers to upload arbitrary files to affected servers. This flaw enables remote code execution (RCE) without requiring any authentication, as attackers can trick the application into downloading and saving malicious files from attacker-controlled (S)FTP servers directly onto the victim’s system. The vulnerability was identified by cybersecurity researchers at watchTowr, who confirmed that the exploit could be used to gain full control over targeted web servers running vulnerable versions of Monsta FTP. Monsta FTP is widely used for web-based file management by organizations ranging from financial institutions to individual website owners, increasing the potential impact of this vulnerability. Security advisories emphasize the critical nature of the flaw, with a CVSS score of 9.3, and recommend immediate patching or mitigation to prevent exploitation. The vulnerability is pre-authentication, meaning attackers do not need valid credentials to exploit it, making unpatched systems especially susceptible to takeover and compromise.
Jul 12, 2026
Two FTP server products were disclosed with serious buffer overflow vulnerabilities that can be triggered remotely. **Core FTP/SFTP Server 1.2** is affected by `CVE-2019-25654`, a flaw in the **User domain** field where an excessively long string of roughly 7,000 bytes can crash the application and cause a denial of service. The issue is classified as `CWE-120`/buffer overflow behavior with impact focused on availability, and public references include advisories from VulnCheck and Exploit-DB. A separate flaw, `CVE-2018-25254`, affects **NICO-FTP 3.0.1.19** and is described as a remote **SEH buffer overflow** reachable through crafted FTP commands containing oversized data. The vulnerability allows unauthenticated attackers to overwrite exception handler pointers and potentially execute injected shellcode, leading to full remote code execution with high impact on confidentiality, integrity, and availability. The disclosures highlight continued risk from legacy FTP software that processes untrusted input without proper bounds checking.
Jun 29, 2026
A high-severity vulnerability tracked as **CVE-2026-63090** affects ProFTPD's `mod_sftp` module and can allow a low-privilege authenticated user to achieve remote code execution. Public reporting describes the bug as a heap-based buffer overflow triggered by crafted SFTP or SSH authentication traffic, with one account tying exploitation to malformed SFTP packet fragment reassembly in `fxp.c` and another linking it to improper bounds checking in `sftp_ssh2_userauth_callback`. In both cases, the flaw can corrupt heap memory and potentially give an attacker control of the ProFTPD process, creating a path to data theft, persistence, and lateral movement. Affected versions cited across disclosures include multiple ProFTPD `1.3.8` and `1.3.9` releases prior to patched builds, with fixes reported in versions such as **1.3.8c**, **1.3.9b**, **1.3.9c**, and **1.3.10rc3** depending on branch and advisory. The issue carries a **CVSS 8.8** rating, and while no active exploitation was reported at disclosure, defenders were urged to patch immediately, disable `mod_sftp` where it is not required, and restrict SSH/SFTP access to trusted users and networks to reduce exposure.
Jul 22, 2026