/Vulnerability Library

Monsta FTP <= 2.14.4 - Unauthenticated SSRF via IPv6 Blocklist Bypass

CVE-2026-60105
Verified

Description

Monsta FTP before 2.14.5 contains a server-side request forgery vulnerability in the fetchRemoteFile action caused by an incomplete IP blocklist check in the isBlockedIP() function, which fails to detect embedded IPv4 addresses within IPv4-mapped IPv6 addresses.

Severity

High

CVSS Score

8.6

Exploit Probability

2%

Affected Product

monsta-ftp

Published Date

September 8, 2026

Template Author

chocapikk, dhiyaneshdk

CVE-2026-60105.yaml
8.6Score

CVSS Metrics

CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
CVE ID:
cve-2026-60105
CWE ID:
cwe-918, cwe-184

References

https://www.vulncheck.com/blog/monsta-ftp-ssrf-ipv6-blocklist-bypass

Remediation Steps

Upgrade to Monsta FTP 2.14.5 or later.