CVE-2026-60105 Monsta FTP < 2.14.5 SSRF via IPv4-Mapped IPv6 Address Bypass
Unauthenticated attackers can bypass IP blocklists via IPv4-mapped IPv6 addresses to access internal services and retrieve cloud metadata credentials.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-60105?
CVE-2026-60105 is a high-severity server-side request forgery vulnerability in Monsta FTP, published on 8 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Monsta FTP before 2.14.5 contains a server-side request forgery vulnerability in the fetchRemoteFile action caused by an incomplete IP blocklist check in the isBlockedIP() function, which fails to detect embedded IPv4 addresses within IPv4-mapped IPv6 addresses. An unauthenticated attacker can obtain a CSRF token from the public getSystemVars endpoint and submit a fetchRemoteFile request with a source URL resolving to an IPv4-mapped address, causing the server to issue HTTP requests to internal services and write responses to an attacker-controlled FTP destination, enabling retrieval of cloud instance metadata credentials.
Weakness: CWE-918
Which versions are affected by CVE-2026-60105?
How do I fix CVE-2026-60105?
No fix has been published for CVE-2026-60105 yet. Limit exposure of the affected software until one is available.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-60105 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-60105 exists.
Public exploit code: 1 Nuclei template.
Sources
Also known as GHSA-hf3x-9vx4-94qv.