FTP Client Vulnerability in Unverified Server Responses from Rapid7
CVE-2026-109681

4.7MEDIUM

Key Information:

Vendor

Rapid7

Status
Metasploit Framework
Vendor
CVE Published:
20 October 2026

What is CVE-2026-109681?

The FTP client from Rapid7 exhibits a critical vulnerability where it accepts the server's PASV response IP and port without proper validation against the established control connection. This flaw allows a malicious FTP server to send a manipulated response, directing the client's machine to establish a TCP connection to an arbitrary and potentially harmful host. This opens the door for various attacks, including data exfiltration and unauthorized access, highlighting the importance of robust validation mechanisms in FTP protocols.

Affected Version(s)

Metasploit Framework MacOS 0 < 6.5.7

References

https://github.com/rapid7/metasploit-framework/pull/21994
patchrelease-notes

CVSS V3.1

Score:
4.7
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Adiel Sol, Arad Inbar, Erez Cohen, Nir Somech, Ben Grinberg, Daniel Lubel, Shir Sadon DREAM Security Research Team
.