# CVE-2025-34299: Monsta FTP - RCE

> Live exploitation tracking for CVE-2025-34299 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2025-34299

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 9.3
- **Public exploit available:** Yes
- **Affected products:** Monsta Limited of New Zealand Monsta FTP
- **Weaknesses:** CWE-434 (Unrestricted Upload of File with Dangerous Type)
- **Tags:** file_sharing

## Description

Monsta FTP versions 2.11 and earlier contain a vulnerability that allows unauthenticated arbitrary file uploads. This flaw enables attackers to execute arbitrary code by uploading a specially crafted file from a malicious (S)FTP server.

## CrowdSec analysis

[CVE-2025-34299](https://euvd.enisa.europa.eu/vulnerability/CVE-2025-34299) is a critical vulnerability in Monsta FTP versions 2.11 and earlier that allows unauthenticated attackers to upload arbitrary files, potentially leading to remote code execution. Exploiting this flaw, threat actors can compromise the server by uploading malicious files from a rogue (S)FTP server, making it a significant risk for web-based file management environments.

CrowdSec has been tracking this vulnerability and its exploits since 12th of November 2025.

According to CrowdSec data, while opportunistic exploitation dominates, a portion of threat actors trying to exploit CVE-2025-34299 apply basic targeting methods such as port or service detection. This indicates emerging patterns of selective targeting.
In addition, according to the CrowdSec network, attack volume against CVE-2025-34299 has dipped slightly compared to the previous week. Although still commonly targeted, the decline suggests a cooling-off period. Long-term relevance remains, but attention is waning.

Attackers exploit Monsta FTP by sending crafted POST requests to `/mftp/application/api/api.php` with malicious SFTP connection parameters, enabling remote file writes and potential code execution on the server.

## Timeline

- 2025-11-07: CVE Published. CVE-2025-34299 is published to NVD.
- 2025-11-12: Rule Released. CrowdSec releases a rule to detect CVE-2025-34299 exploitation attempts against the CrowdSec Network.
- 2025-11-26: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2025-34299 for the first time.

## References

- https://labs.watchtowr.com/whats-that-coming-over-the-hill-monsta-ftp-remote-code-execution-cve-2025-34299/
- https://www.vulncheck.com/advisories/monsta-ftp-unauthenticated-arbitrary-file-upload
- https://www.monstaftp.com/notes/
- https://github.com/rix4uni/cvemapping/blob/main/2025/CVE-2025-34299/exploit.py

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2025-34299) follows observed exploitation activity for CVE-2025-34299. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.