CVE-2026-60105

Name of the Vulnerable Software and Affected Versions Monsta FTP versions prior to 2.14.5

Description An unauthenticated server-side request forgery (SSRF) exists due to an incomplete IP blocklist check in the isBlockedIP() function, which fails to detect embedded IPv4 addresses within IPv4-mapped IPv6 addresses. An attacker can obtain a CSRF token from the getSystemVars endpoint and submit a request to the fetchRemoteFile action using a source URL that resolves to an IPv4-mapped address. This allows the server to issue HTTP requests to internal services and write the responses to an attacker-controlled FTP destination, potentially exposing cloud instance metadata credentials.

Recommendations Update to version 2.14.5 or later. Restrict access to the fetchRemoteFile action as a temporary mitigation measure.