A critical arbitrary file upload vulnerability in Monstra CMS 3.0.4 allows authenticated attackers to achieve remote code execution.

This vulnerability resides in the Files Manager plugin, which utilizes an ineffective blacklist-based validation method for file uploads. An authenticated attacker can upload malicious scripts to a web-accessible directory, leading to code execution on the underlying server.

Successful exploitation allows an attacker to gain full control over the web server, potentially leading to total system compromise, data exfiltration, or the defacement of the hosted website. With a CVSS score of 8.8, this vulnerability represents a high risk to organizational security and service availability, necessitating immediate attention to prevent unauthorized access or persistence.

Immediate Action: Since a specific patch is not currently identified, administrators should disable the Files Manager plugin within the Monstra CMS environment until a secure version or official fix is released.

Proactive Monitoring: Review web server access logs for suspicious file upload requests, particularly those involving file extensions associated with server-side scripts like .php, .phtml, or .inc.

Compensating Controls: Implement strict file type filtering at the Web Application Firewall (WAF) level to prevent the upload of executable file types to the storage directory.

Public Exploit Available: Yes, a published proof-of-concept exists, attributed to the researcher's write-up on GitHub.

Given the severity of potential remote code execution, organizations currently running Monstra CMS 3.0.4 must treat this as a high-priority issue. If the Files Manager plugin is not strictly required for business operations, it should be deactivated immediately to eliminate the attack vector while awaiting further guidance or a vendor-supplied security update.