CVE-2026-27699 - Vulnerability Analysis

Overview

basic-ftp FTP client library for Node.js < 5.2.0 contains a path traversal caused by improper handling of directory listings in downloadToDir() method, letting malicious FTP servers write files outside intended directories, exploit requires interaction with a malicious FTP server.

Severity & Score

Impact

Malicious FTP servers can write files outside intended directories, potentially overwriting critical files and compromising the system.

Mitigation

Update to version 5.2.0 or later.

References

• https://github.com/patrickjuchli/basic-ftp/releases/tag/v5.2.0
• https://github.com/patrickjuchli/basic-ftp/security/advisories/GHSA-5rq4-664w-9x2c
• https://github.com/patrickjuchli/basic-ftp/commit/2a2a0e6514357b9eda07c2f8afbd3f04727a7cd9

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner