Monsta FTP versions 2.11 and earlier have a critical vulnerability that allows unauthenticated attackers to upload arbitrary files. This can lead to remote code execution by uploading specially crafted files from a malicious (S)FTP server. The vulnerability is identified as CWE-434 and has a high CVSS 4.0 score of 9.3. Public exploit code is available via Metasploit, and detection templates exist for automated scanning. No official patch or remediation details are provided in the available data.