CVE-2026-60105 is a server-side request forgery vulnerability in Monsta FTP before version 2.14.5. The issue is due to an incomplete IP blocklist check in the isBlockedIP() function, which does not properly detect IPv4 addresses embedded within IPv4-mapped IPv6 addresses. An attacker without authentication can obtain a CSRF token from the public getSystemVars endpoint and use it to submit a fetchRemoteFile request with a source URL resolving to an IPv4-mapped address. This causes the server to issue HTTP requests to internal services and write responses to an attacker-controlled FTP destination, potentially exposing cloud instance metadata credentials.

An unauthenticated attacker can exploit this vulnerability to perform SSRF attacks, allowing them to make HTTP requests from the server to internal services that are otherwise inaccessible. This can lead to unauthorized access to sensitive information such as cloud instance metadata credentials, which could be used for further attacks or privilege escalation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the vulnerable fetchRemoteFile functionality if possible and monitor for suspicious requests targeting internal resources. Avoid exposing the getSystemVars endpoint publicly if feasible.