CVE-2026-60105
published 2026-07-08CVE-2026-60105: Monsta FTP before 2.14.5 contains a server-side request forgery vulnerability in the fetchRemoteFile action caused by an incomplete IP blocklist check in the…
PriorityP181high8.6CVSS 3.1
AVNACLPRNUINSCCHINAN
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
1.51%
74.3th percentile
Monsta FTP before 2.14.5 contains a server-side request forgery vulnerability in the fetchRemoteFile action caused by an incomplete IP blocklist check in the isBlockedIP() function, which fails to detect embedded IPv4 addresses within IPv4-mapped IPv6 addresses. An unauthenticated attacker can obtain a CSRF token from the public getSystemVars endpoint and submit a fetchRemoteFile request with a source URL resolving to an IPv4-mapped address, causing the server to issue HTTP requests to internal services and write responses to an attacker-controlled FTP destination, enabling retrieval of cloud instance metadata credentials.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| monsta_limited_of_new_zealand | monsta_ftp | < 2.14.5 | 2.14.5 |
CVSS provenance
nvdv3.18.6HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
nvdv4.07.7HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vulncheck8.6HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Monsta Limited of New Zealand Monsta FTP up to 2.14.4 IP Blocklist isBlockedIP URL server-side request forgery
vuldb·2026-07-09·CVSS 8.6
CVE-2026-60105 [HIGH] Monsta Limited of New Zealand Monsta FTP up to 2.14.4 IP Blocklist isBlockedIP URL server-side request forgery
A vulnerability classified as problematic has been found in Monsta Limited of New Zealand Monsta FTP up to 2.14.4. Affected by this issue is the function isBlockedIP of the component IP Blocklist Handler. Performing a manipulation of the argument URL results in server-side request forgery.
This vulnerability was named CVE-2026-60105. The attack may be initiated remotely. There is no available exploit.
GHSA
Monsta FTP before 2.14.5 contains a server-side request forgery vulnerability in the fetchRemoteFile action caused by an incomplete IP blocklist check in the isBlockedIP() function, which fails to det
ghsa_unreviewed·2026-07-08
CVE-2026-60105 [HIGH] CWE-918 Monsta FTP before 2.14.5 contains a server-side request forgery vulnerability in the fetchRemoteFile action caused by an incomplete IP blocklist check in the isBlockedIP() function, which fails to det
Monsta FTP before 2.14.5 contains a server-side request forgery vulnerability in the fetchRemoteFile action caused by an incomplete IP blocklist check in the isBlockedIP() function, which fails to detect embedded IPv4 addresses within IPv4-mapped IPv6 addresses. An unauthenticated attacker can obtain a CSRF token from the public getSystemVars endpoint and submit a fetchRemoteFile request with a source URL resolving to an IPv4-mapped address, causing the server to issue HTTP requests to internal services and write responses to an attacker-controlled FTP destination, enabling retrieval of cloud instance metadata credentials.
VulnCheck
monstaftp monsta_ftp Server-Side Request Forgery (SSRF)
vulncheck·2026·CVSS 8.6
CVE-2026-60105 [HIGH] monstaftp monsta_ftp Server-Side Request Forgery (SSRF)
monstaftp monsta_ftp Server-Side Request Forgery (SSRF)
Monsta FTP before 2.14.5 contains a server-side request forgery vulnerability in the fetchRemoteFile action caused by an incomplete IP blocklist check in the isBlockedIP() function, which fails to detect embedded IPv4 addresses within IPv4-mapped IPv6 addresses. An unauthenticated attacker can obtain a CSRF token from the public getSystemVars endpoint and submit a fetchRemoteFile request with a source URL resolving to an IPv4-mapped address, causing the server to issue HTTP requests to internal services and write responses to an attacker-controlled FTP destination, enabling retrieval of cloud instance metadata credentials.
Affected: monstaftp monsta_ftp
Required Action: Apply remediations or mitigations per vendor instructions or d
No detection rules found.
Nuclei
Monsta FTP <= 2.14.4 - Unauthenticated SSRF via IPv6 Blocklist Bypass
nuclei·CVSS 8.6
CVE-2026-60105 [HIGH] Monsta FTP <= 2.14.4 - Unauthenticated SSRF via IPv6 Blocklist Bypass
Monsta FTP <= 2.14.4 - Unauthenticated SSRF via IPv6 Blocklist Bypass
Monsta FTP before 2.14.5 contains a server-side request forgery vulnerability in the fetchRemoteFile action caused by an incomplete IP blocklist check in the isBlockedIP() function, which fails to detect embedded IPv4 addresses within IPv4-mapped IPv6 addresses.
Template:
id: CVE-2026-60105
info:
name: Monsta FTP <= 2.14.4 - Unauthenticated SSRF via IPv6 Blocklist Bypass
author: chocapikk,DhiyaneshDk
severity: high
description: |
Monsta FTP before 2.14.5 contains a server-side request forgery vulnerability in the fetchRemoteFile action caused by an incomplete IP blocklist check in the isBlockedIP() function, which fails to detect embedded IPv4 addresses within IPv4-mapped IPv6 addresses.
impact: |
An unauthenticated
2026-07-08
Published
Exploited in the wild