CVE-2026-27699 - Vulnerability Analysis

Overview

basic-ftp FTP client library for Node.js < 5.2.0 contains a path traversal caused by improper handling of directory listings in downloadToDir() method, letting malicious FTP servers write files outside intended directories, exploit requires interaction with a malicious FTP server.

Severity & Score

Impact

Malicious FTP servers can write files outside intended directories, potentially overwriting critical files and compromising the system.

Mitigation

Update to version 5.2.0 or later.

References

• https://github.com/patrickjuchli/basic-ftp/security/advisories/GHSA-5rq4-664w-9x2c
• https://github.com/patrickjuchli/basic-ftp/commit/2a2a0e6514357b9eda07c2f8afbd3f04727a7cd9
• https://github.com/patrickjuchli/basic-ftp/releases/tag/v5.2.0

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Feb 25, 2026

🔴 CVE-2026-27699 - Critical (9.1) The `basic-ftp` FTP client library for Node.js contains a path traversal vulnerability (CWE-22) in versions prior to 5.2.0 in the `downloadToDir()` method. A malicious FTP server can send directory listings with filenames containing path traversa... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27699/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner