CVE-2026-109681: Metasploit Framework FTP PASV Response SSRF
The FTP client trusts the server's PASV response IP:port without validation against the control connection target. A rogue FTP server can specify any IP:port in the 227 Passive Mode response, causing the operator's machine to open a TCP connection to an arbitrary host.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Operators using the Metasploit Framework FTP client against an untrusted or rogue FTP server are exposed. The server can influence the operator's machine to initiate a TCP connection elsewhere.
What must an attacker do to exploit it?
An attacker needs to operate or control an FTP server that the operator connects to, then return a crafted 227 Passive Mode response containing an arbitrary IP address and port. Exploitation also requires operator interaction because the operator must initiate the FTP connection.
What is the impact of a successful exploit?
The operator's machine can be induced to open a TCP connection to an arbitrary host and port selected by the rogue FTP server. The provided information identifies this as SSRF and indicates limited confidentiality impact, with no stated integrity or availability impact.