Monsta FTP versions prior to 2.14.5 contain a server‑side request forgery flaw (CWE‑918) caused by an IPv4 addresses embedded within IPv4‑mapped IPv6 addresses. An unauthenticated attacker can first obtain a CSRF token from the publicly accessible getSystemVars endpoint and then submit a fetchRemoteFile request whose source URL resolves to a mapped IPv4 address. The server will make an HTTP request to the internal service, retrieve the response, and write the data to an FTP destination under the attacker’s control, allowing the exfiltration of cloud‑instance metadata credentials.

The vulnerability affects all installations of Monsta FTP produced by Monsta Limited of New Zealand running any version earlier than 2.14.5. The CNA specifies that version 2.14.5 contains the fix.

The CVSS score of 7.7 classifies this vulnerability as high severity. The EPSS score of <1% indicates a very low but non‑zero likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, one can infer that the attack vector is remote web traffic: an unauthenticated user could send HTTP requests to the fetchRemoteFile endpoint from outside the network. Because the server can pull data from internal services and exfiltrate it via FTP, the risk is significant, especially for cloud deployments where metadata services expose credentials.