CVE-2026-109681 PUBLISHED

Metasploit Framework FTP PASV Response SSRF

Assigner: rapid7
Reserved: 12.10.2026 Published: 20.10.2026 Updated: 20.10.2026

The FTP client trusts the server's PASV response IP:port without validation against the control connection target. A rogue FTP server can specify any IP:port in the 227 Passive Mode response, causing the operator's machine to open a TCP connection to an arbitrary host.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N
CVSS Score: 4.7

Attack Vector	Network	Scope	Changed
Attack Complexity	Low	Confidentiality Impact	Low
Privileges Required	None	Integrity Impact	None
User Interaction	Required	Availability Impact	None

CVSS 3.1

Product Status

Vendor	Rapid7
Product	Metasploit Framework
Versions	Default: unaffected affected from 0 to 6.5.7 (excl.)

Credits

Adiel Sol, Arad Inbar, Erez Cohen, Nir Somech, Ben Grinberg, Daniel Lubel, Shir Sadon DREAM Security Research Team finder

References

https://github.com/rapid7/metasploit-framework/pull/21994

Problem Types

CWE-918 Server-Side request forgery (SSRF) CWE

Impacts

CAPEC-300 Port Scanning