CVE-2026-27699: Basic FTP has Path Traversal Vulnerability in its downloadToDir() method
Vulnerability summary
CVE-2026-27699 is a critical (CVSS 9.8) vulnerability in patrickjuchli basic-ftp. EPSS estimates a 0.94% chance of exploitation in the next 30 days, higher than 60.9% of scored vulnerabilities. 1 public exploit is recorded.
Public exploit (GitHub, Date unknown)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 1 · Related 2Timeline
- 25-02-2026PublishedVulnerability first disclosed.
- 27-02-2026Last modifiedVulnerability information updated.
Description
The `basic-ftp` FTP client library for Node.js contains a path traversal vulnerability (CWE-22) in versions prior to 5.2.0 in the `downloadToDir()` method. A malicious FTP server can send directory listings with filenames containing path traversal sequences (`../`) that cause files to be written outside the intended download directory. Version 5.2.0 patches the issue.
CVSS metrics
7 scores · 7 sources · 1 version- CVE.orgCNA9.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:HDiffers
- OSV · UbuntuEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · WolfiEcosystem advisory · calculated9.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:HDiffers
- OSV · NpmEcosystem advisory · calculated9.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:HDiffers
- OSV · ChainguardEcosystem advisory · calculated9.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:HDiffers
EPSS trend
Probability
0.94%
Chance of exploitation in the next 30 days
Percentile
61%
Versus all other CVEs
30-day change
Decrease -0.07 pp
From 1.01% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundBasic Ftp
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Chainguard28 products
- code-server< 4.106.3-r6
- kibana-7All versions (No fix recorded)
- kibana-8.17< 8.17.10-r11
- kibana-8.17-iamguarded< 8.17.10-r11
- kibana-8.18All versions (No fix recorded)
Wolfi3 products
- code-server< 4.106.3-r6
- langfuse-3-worker< 3.155.1-r3
- opensearch-dashboards-3-security-dashboards-plugin< 3.5.0-r4
Debian1 product
- node-proxy-agents< 0~2024040606-6+deb13u1 | < 0~2025070717+~cs15.2.7-1
Npm1 product
- basic-ftp< 5.2.0
Patrickjuchli1 product
- basic-ftp< 5.2.0
Ubuntu1 product
- node-proxy-agentsAll versions (No fix recorded)
6 vendors · 35 products
References
9 links- github.com/patrickjuchli/basic-ftp/security/advisories/GHSA-5rq4-664w-9x2cX Refsource CONFIRMREPORTAdvisoryWEBExploitMitigationVendor Advisory
- github.com/patrickjuchli/basic-ftp/commit/2a2a0e6514357b9eda07c2f8afbd3f04727a7cd9X Refsource MISCREPORTFIXWEBPatch
