CVE-2026-60105 is a server-side request forgery vulnerability in Monsta FTP before version 2.14.5. The vulnerability arises from an incomplete IP blocklist check in the isBlockedIP() function, which does not properly detect IPv4 addresses embedded within IPv4-mapped IPv6 addresses. An unauthenticated attacker can obtain a CSRF token from the public getSystemVars endpoint and then submit a fetchRemoteFile request with a source URL resolving to an IPv4-mapped address. This causes the server to issue HTTP requests to internal services and write the responses to an attacker-controlled FTP destination, enabling the attacker to retrieve cloud instance metadata credentials.

An unauthenticated attacker can exploit this vulnerability to perform SSRF attacks that access internal services not normally reachable externally. The attacker can cause the server to fetch internal resources and write their responses to an attacker-controlled FTP location, potentially exposing sensitive information such as cloud instance metadata credentials. This can lead to further compromise of the affected environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is provided at this time. Until a patch is available, restrict access to the vulnerable fetchRemoteFile functionality if possible and monitor for suspicious requests. Follow the vendor's guidance once it becomes available.