SHSelfHostIndex
MO

Monstra

Lightweight flat-file CMS that needs no database

Content Management Systems ★ 388 stars Easy setup GPL-3.0

Monstra is a small, fast content management system that stores all content in flat files instead of a database. It is designed to be simple to deploy and maintain, making it suitable for small sites and brochure pages.

Official siteSource code

Key features

  • Flat-file storage
  • Plugin system
  • Simple page editor
  • Low resource usage

Strengths

  • Released under the GPL-3.0 license
  • Easy to set up — beginner-friendly
  • Written in PHP
  • Tiny footprint — runs in 64 MB RAM

Is Monstra secure?

33 known vulnerabilities affect Monstra's latest release (v3.0.4) according to OSV.dev; the most severe is rated critical.

Affecting v3.0.4

AdvisorySeveritySummary
CVE-2020-25414CriticalA local file inclusion vulnerability was discovered in the captcha function in Monstra 3.0.4 which allows remote attackers to execute arbitrary PHP code.
CVE-2021-36548CriticalA remote code execution (RCE) vulnerability in the component /admin/index.php?id=themes&action=edit_template&filename=blog of Monstra v3.0.4 allows attackers to execute arbitrary commands via a cra...
CVE-2021-40940CriticalMonstra 3.0.4 does not filter the case of php, which leads to an unrestricted file upload vulnerability.
CVE-2017-18048HighMonstra CMS 3.0.4 allows users to upload arbitrary files, which leads to remote command execution on the server, for example because .php (lowercase) is blocked but .PHP (uppercase) is not.
CVE-2018-16608HighIn Monstra CMS 3.0.4, an attacker with 'Editor' privileges can change the password of the administrator via an admin/index.php?id=users&action=edit&user_id=1, Insecure Direct Object Reference (IDOR).
CVE-2018-6383HighMonstra CMS through 3.0.4 has an incomplete "forbidden types" list that excludes .php (and similar) file extensions but not the .pht or .phar extension, which allows remote authenticated Admins or...
CVE-2018-9037HighMonstra CMS 3.0.4 allows remote code execution via an upload_file request for a .zip file, which is automatically extracted and may contain .php files.
CVE-2020-13384HighMonstra CMS 3.0.4 allows remote authenticated users to upload and execute arbitrary PHP code via admin/index.php?id=filesmanager because, for example, .php filenames are blocked but .php7 filenames...
CVE-2018-11474HighMonstra CMS 3.0.4 has a Session Management Issue in the Administrations Tab.
CVE-2018-11475HighMonstra CMS 3.0.4 has a Session Management Issue in the Users tab.

Showing 10 of 33.

7 unconfirmed matches

OSV.dev links these advisories to this release, but their own version data doesn't confirm it: they cover a separately versioned sub-package of the repository, or record the fix only as a commit. They are listed for completeness and not counted in the health score.

Matched by OSV, not confirmed

AdvisorySeveritySummary
CVE-2018-11678Criticalplugins/box/users/users.plugin.php in Monstra CMS 3.0.4 allows Login Rate Limiting Bypass via manipulation of the login_attempts cookie.
CVE-2020-23219HighMonstra CMS 3.0.4 allows attackers to execute arbitrary code via a crafted payload entered into the "Snippet content" field under the "Edit Snippet" module.
CVE-2025-69906HighMonstra CMS v3.0.4 contains an arbitrary file upload vulnerability in the Files Manager plugin.
CVE-2020-13978HighMonstra CMS 3.0.4 allows an attacker, who already has administrative access to modify .chunk.php files on the Edit Chunk screen, to execute arbitrary OS commands via the Theme Module by visiting th...
CVE-2020-20691MediumAn issue in Monstra CMS v3.0.4 allows attackers to execute arbitrary web scripts or HTML via bypassing the file extension filter and uploading crafted HTML files.
CVE-2020-23205MediumA stored cross site scripting (XSS) vulnerability in Monstra CMS version 3.0.4 allows attackers to execute arbitrary web scripts or HTML via crafted a payload entered into the "Site Name" field und...
CVE-2020-23697MediumCross Site Scripting vulnerabilty in Monstra CMS 3.0.4 via the page feature in admin/index.php.
  • Most recent fixed advisory CVE-2018-11227, published 2019-07-03 (2660 days ago), fixed in 3.0.4

Source: OSV.dev, checked 2026-10-14. How this is measured.

Monstra replaces

Self-hosted WordPress alternatives

Health badge

Maintain Monstra? Add its health score to your README. The badge links back to this page.

SelfHostIndex: 7 · at risk

Markdown
[![SelfHostIndex health score for Monstra](https://selfhostindex.com/badge/monstra.svg)](https://selfhostindex.com/app/monstra/)
HTML
<a href="https://selfhostindex.com/app/monstra/"><img src="https://selfhostindex.com/badge/monstra.svg" alt="SelfHostIndex health score for Monstra"></a>
reStructuredText
.. image:: https://selfhostindex.com/badge/monstra.svg
   :alt: SelfHostIndex health score for Monstra
   :target: https://selfhostindex.com/app/monstra/

The score is recomputed on every nightly rebuild from public repository data — see how it is calculated.

Similar content management systems apps