This page lists publicly disclosed CVE vulnerabilities affecting monstaftp monsta_ftp (linked via NVD CPE). Each row includes severity scores, summaries, and publication dates to help identify and analyze security issues.
| CVE | Summary | Source | Max CVSS | EPSS % | Published | Updated |
|---|---|---|---|---|---|---|
| CVE-2026-60105 | Monsta FTP before 2.14.5 contains a server-side request forgery vulnerability in the fetchRemoteFile action caused by an incomplete IP blocklist check in the isBlockedIP() function, which fails to detect embedded IPv4 addresses within IPv4-mapped IPv6 addresses. An unauthenticated attacker can obtain a CSRF token from the public getSystemVars endpoint and submit a fetchRemoteFile request with a source URL resolving to an IPv4-mapped address, causing the server to issue HTTP requests to internal | [email protected] | 7.7 | 0.35% | 2026-07-08 | 2026-07-14 |
| CVE-2025-34299 | Monsta FTP versions 2.11 and earlier contain a vulnerability that allows unauthenticated arbitrary file uploads. This flaw enables attackers to execute arbitrary code by uploading a specially crafted file from a malicious (S)FTP server. | [email protected] | 9.3 | 72.67% | 2025-11-07 | 2026-06-17 |
| CVE-2022-27469 | Monstaftp v2.10.3 was discovered to allow attackers to execute Server-Side Request Forgery (SSRF). | [email protected] | 9.8 | 1.37% | 2022-04-26 | 2026-06-17 |
| CVE-2022-27468 | Monstaftp v2.10.3 was discovered to contain an arbitrary file upload which allows attackers to execute arbitrary code via a crafted file uploaded to the web server. | [email protected] | 9.8 | 2.01% | 2022-04-26 | 2026-06-17 |
| CVE-2020-14057 | Monsta FTP 2.10.1 or below allows external control of paths used in filesystem operations. This allows attackers to read and write arbitrary local files, allowing an attacker to gain remote code execution in common deployments. | [email protected] | 9.8 | 2.58% | 2020-07-01 | 2026-06-16 |
| CVE-2020-14056 | Monsta FTP 2.10.1 or below is prone to a server-side request forgery vulnerability due to insufficient restriction of the web fetch functionality. This allows attackers to read arbitrary local files and interact with arbitrary third-party services. | [email protected] | 9.8 | 1.33% | 2020-07-01 | 2026-06-16 |
| CVE-2020-14055 | Monsta FTP 2.10.1 or below is prone to a stored cross-site scripting vulnerability in the language setting due to insufficient output encoding. | [email protected] | 6.1 | 0.70% | 2020-07-01 | 2026-06-16 |