Monsta FTP vulnerabilities

2 known vulnerabilities in Monsta FTP from Monsta Limited of New Zealand. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.6 High severity

  Monsta FTP: Server-Side Request Forgery

  CVE-2026-60105Jul 8, 2026Monsta Limited of New ZealandEPSS 1.51%

  Monsta FTP before 2.14.5 contains a server-side request forgery vulnerability in the fetchRemoteFile action caused by an incomplete IP blocklist check in the isBlockedIP() function, which fails to detect embedded IPv4 addresses within IPv4-mapped IPv6 addresse

• 9.8 Critical severity

  Monsta FTP: Unrestricted Upload of File with Dangerous Type

  CVE-2025-34299Nov 7, 2025Monsta Limited of New ZealandEPSS 72.7%

  Monsta FTP versions 2.11 and earlier contain a vulnerability that allows unauthenticated arbitrary file uploads. This flaw enables attackers to execute arbitrary code by uploading a specially crafted file from a malicious (S)FTP server.