Widespread web server hijacking likely with critical Monsta FTP flaw

HackRead reports that at least 5,000 web servers could be hijacked in attacks weaponizing the critical pre-authentication vulnerability impacting the Monsta FTP web-based file management app, which could result in remote code execution.

Threat actors could leverage the flaw, tracked as CVE-2025-34299, to lure Monsta FTP into downloading and saving a malicious file within the targeted server that would subsequently enable total server or hosting environment control, according to an analysis from watchTowr researchers.

"It connected, pulled our payload, and wrote it to the specified path," said researchers, who discovered the issue while investigating known Monsta FTP bugs, including the server-side request forgery and arbitrary file upload defects, tracked as CVE-2022-31827, CVE-2022-27469, and CVE-2022-27468. The flaws are suspected to have persisted in newer Monsta FTP iterations.

Such a severe threat posed by CVE-2025-34299 should prompt the immediate implementation of Monsta FTP version 2.11.3 or later among affected organizations.