Monsta FTP before 2.14.5 contains a server-side request forgery vulnerability in the fetchRemoteFile action caused by an incomplete IP blocklist check in the isBlockedIP() function, which fails to detect embedded IPv4 ad…
CVSS 4.0HIGH 7.7·Network·No auth·No interaction·EPSS 0.01514·Published 2026-07-08·Fixed in 2.14.5CWE-918