Vulnerability · Published Jul 8, 2026 · Assigned by VulnCheck

CVE-2026-60105Monsta FTP < 2.14.5 SSRF via IPv4-Mapped IPv6 Address Bypass

High 8.6

In plain English

A high-severity server-side request forgery in Monsta FTP from Monsta Limited of New Zealand. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.5% (higher than 75% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.

Severity (CVSS 3.1)8.6High

Exploit odds (30 days)1.5%top 25.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling1Nuclei

Official description

Monsta FTP before 2.14.5 contains a server-side request forgery vulnerability in the fetchRemoteFile action caused by an incomplete IP blocklist check in the isBlockedIP() function, which fails to detect embedded IPv4 addresses within IPv4-mapped IPv6 addresses. An unauthenticated attacker can obtain a CSRF token from the public getSystemVars endpoint and submit a fetchRemoteFile request with a source URL resolving to an IPv4-mapped address, causing the server to issue HTTP requests to internal services and write responses to an attacker-controlled FTP destination, enabling retrieval of cloud instance metadata credentials.

Affected products (as reported)

Vendor	Product	Versions
Monsta Limited of New Zealand	Monsta FTP	0 – before 2.14.5

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

References

VulnCheck Blog technical-description, exploit
Release Notes patch, release-notes
https://www.vulncheck.com/advisories/monsta-ftp-ssrf-via-ipv4-mapped-ipv6-address-bypass third-party-advisory