CVE-2026-109681— Metasploit Framework FTP PASV Response SSRF
Quick assessment
Affected
Rapid7 Metasploit Framework
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
FTP 客户端在未对控制连接的目标地址进行验证的情况下，直接信任服务器返回的 PASV 响应中的 IP 地址和端口。恶意 FTP 服务器可在 227 被动模式响应中指定任意 IP:端口，从而导致操作员机器向任意主机发起 TCP 连接。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-109681
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Metasploit Framework FTP PASV Response SSRF
Source: CVE Program / CVE List V5
Vulnerability Description
The FTP client trusts the server's PASV response IP:port without validation against the control connection target. A rogue FTP server can specify any IP:port in the 227 Passive Mode response, causing the operator's machine to open a TCP connection to an arbitrary host.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
服务端请求伪造(SSRF)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Rapid7 | Metasploit Framework | 0 ~ 6.5.7 | - |
|
II. Public POCs for CVE-2026-109681
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-109681
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-109681 (1)
IV. Related Vulnerabilities
Same product: Metasploit Framework
-
CVE-2026-109682
Metasploit Framework HTTP Redirect Server-Side Request Forge -
CVE-2026-87689
Metasploit Framework Web Service REST API Missing Authentica -
CVE-2026-87690
Metasploit Framework ios_image_gather Path Traversal Leading -
CVE-2020-7385
Metasploit Framework 'drb_remote_codeexec' code execution -
CVE-2019-5645
Rapid7 Metasploit HTTP Handler Denial of Service
Same vendor: Rapid7
-
CVE-2026-109682
Metasploit Framework HTTP Redirect Server-Side Request Forge -
CVE-2026-87689
Metasploit Framework Web Service REST API Missing Authentica -
CVE-2026-87690
Metasploit Framework ios_image_gather Path Traversal Leading -
CVE-2026-78413
Velociraptor privilege escalation via SysmonLogForward clien -
CVE-2026-78411
Velociraptor Server Metadata update with Insufficient Permis
Same weakness: CWE-918
-
CVE-2026-17557
Lm-evaluation-harness: lm-evaluation-harness: ssrf via job-s -
CVE-2026-114080
Trigger.dev before 4.5.2 Blind SSRF via Alert-Channel Webhoo -
CVE-2026-114076
Trigger.dev before 4.5.2 Blind SSRF via Alert Channel Webhoo -
CVE-2026-114074
Trigger.dev before 4.5.10 Webhook SSRF Protection Bypass via -
CVE-2026-114062
SvelteKit before 3.0.0 SSRF via Redirects in Server-Side Sel
V. Comments for CVE-2026-109681
No comments yet