{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-109681","assignerOrgId":"9974b330-7714-4307-a722-5648477acda7","state":"PUBLISHED","assignerShortName":"rapid7","dateReserved":"2026-10-12T22:16:38.505Z","datePublished":"2026-10-20T23:11:51.931Z","dateUpdated":"2026-10-20T23:11:51.931Z"},"containers":{"cna":{"providerMetadata":{"orgId":"9974b330-7714-4307-a722-5648477acda7","shortName":"rapid7","dateUpdated":"2026-10-20T23:11:51.931Z"},"title":"Metasploit Framework FTP PASV Response SSRF","problemTypes":[{"descriptions":[{"lang":"en","cweId":"CWE-918","description":"CWE-918 Server-Side request forgery (SSRF)","type":"CWE"}]}],"impacts":[{"capecId":"CAPEC-300","descriptions":[{"lang":"en","value":"CAPEC-300 Port Scanning"}]}],"affected":[{"vendor":"Rapid7","product":"Metasploit Framework","platforms":["MacOS","Windows","Linux"],"repo":"https://github.com/rapid7/metasploit-framework","modules":["All FTP scanner modules using PASV mode"],"programFiles":["lib/msf/core/exploit/remote/ftp.rb"],"versions":[{"status":"affected","version":"0","lessThan":"6.5.7","versionType":"semver"}],"defaultStatus":"unaffected"}],"descriptions":[{"lang":"en","value":"The FTP client trusts the server's PASV response IP:port without validation against the control connection target. A rogue FTP server can specify any IP:port in the 227 Passive Mode response, causing the operator's machine to open a TCP connection to an arbitrary host.","supportingMedia":[{"type":"text/html","base64":false,"value":"<div>The FTP client trusts the server's PASV response IP:port without validation against the control connection target. A rogue FTP server can specify any IP:port in the 227 Passive Mode response, causing the operator's machine to open a TCP connection to an arbitrary host.</div><br>"}]}],"references":[{"url":"https://github.com/rapid7/metasploit-framework/pull/21994","tags":["patch","release-notes"]}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV3_1":{"version":"3.1","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE","baseSeverity":"MEDIUM","baseScore":4.7,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N"}}],"credits":[{"lang":"en","value":"Adiel Sol, Arad Inbar, Erez Cohen, Nir Somech, Ben Grinberg, Daniel Lubel, Shir Sadon   DREAM Security Research Team","type":"finder"}],"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 1.0.5"}}}}