Skip to content
Sign in
9.1 Critical

CVE-2026-27699 The `basic-ftp` FTP client library for Node.js contains a path traversal vulnerability (CWE-22) in versions prior to…

Description

The `basic-ftp` FTP client library for Node.js contains a path traversal vulnerability (CWE-22) in versions prior to 5.2.0 in the `downloadToDir()` method. A malicious FTP server can send directory listings with filenames containing path traversal sequences (`../`) that cause files to be written outside the intended download directory. Version 5.2.0 patches the issue.

Affected products and versions

Product Affected versions Fixed in
basic-ftp 5.2 earliest → < 5.2.0 5.2.0

Other CVEs of basic-ftp

The 5 CVEs of basic-ftp →
CVE-2026-102990 basic-ftp is an FTP client for Node.js 8.2 High CVE-2026-44240 basic-ftp is an FTP client for Node.js 7.5 High CVE-2026-41324 basic-ftp is an FTP client for Node.js 7.5 High CVE-2026-39983 basic-ftp is an FTP client for Node.js 8.6 High
Track this CVE