Monsta FTP SSRF via IPv4-mapped IPv6 Bypass

Publication date: 2026-07-08

Last updated on: 2026-07-08

Assigner: VulnCheck

Description

Monsta FTP before 2.14.5 contains a server-side request forgery vulnerability in the fetchRemoteFile action caused by an incomplete IP blocklist check in the isBlockedIP() function, which fails to detect embedded IPv4 addresses within IPv4-mapped IPv6 addresses. An unauthenticated attacker can obtain a CSRF token from the public getSystemVars endpoint and submit a fetchRemoteFile request with a source URL resolving to an IPv4-mapped address, causing the server to issue HTTP requests to internal services and write responses to an attacker-controlled FTP destination, enabling retrieval of cloud instance metadata credentials.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-08

Last Modified

2026-07-08

Generated

2026-07-09

AI Q&A

2026-07-09

EPSS Evaluated

N/A

NVD

CVE-2026-60105

Affected Vendors & Products

Vendor	Product	Version / Range
monsta_ftp	monsta_ftp	to 2.14.5 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-918	The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

Executive Summary

This vulnerability exists in Monsta FTP versions before 2.14.5 and is a server-side request forgery (SSRF) issue in the fetchRemoteFile action. It is caused by an incomplete IP blocklist check in the isBlockedIP() function, which fails to detect embedded IPv4 addresses within IPv4-mapped IPv6 addresses. An unauthenticated attacker can exploit this by obtaining a CSRF token from the public getSystemVars endpoint and then submitting a fetchRemoteFile request with a source URL that resolves to an IPv4-mapped address. This causes the server to make HTTP requests to internal services and write the responses to an attacker-controlled FTP destination.

This allows the attacker to retrieve sensitive information such as cloud instance metadata credentials.

Impact Analysis

The impact of this vulnerability is that an unauthenticated attacker can exploit the SSRF flaw to make the server send HTTP requests to internal services that are normally inaccessible from outside. The attacker can then capture the responses by having them written to an FTP location they control.

This can lead to the disclosure of sensitive internal information, including cloud instance metadata credentials, which could be used to further compromise the system or cloud environment.

Hi! I’m here to help you understand CVE-2026-60105. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70