CVE-2026-27699

Published February 25th, 2026

View on NVD ↗

CVSS v3

9.1

CRITICAL

CVSS v2

N/A

Affected

PROJECT

Description

The `basic-ftp` FTP client library for Node.js contains a path traversal vulnerability (CWE-22) in versions prior to 5.2.0 in the `downloadToDir()` method. A malicious FTP server can send directory listings with filenames containing path traversal sequences (`../`) that cause files to be written outside the intended download directory. Version 5.2.0 patches the issue.

patrickjuchli/basic-ftp

FTP client for Node.js, supports FTPS over TLS, passive mode over IPv6, async/await, and Typescript.

GitHub

727