CVE-2026-39983: FTP Command Injection via CRLF in basic-ftp
Vulnerability summary
CVE-2026-39983 is a high (CVSS 8.6) vulnerability in patrickjuchli basic-ftp. EPSS estimates a 2.19% chance of exploitation in the next 30 days, higher than 82.4% of scored vulnerabilities. 1 public exploit is recorded.
Public exploit (GitHub, Date unknown)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 0 · Related 1Timeline
- 09-04-2026PublishedVulnerability first disclosed.
- 15-07-2026Last modifiedVulnerability information updated.
Description
basic-ftp is an FTP client for Node.js. Prior to 5.2.1, basic-ftp allows FTP command injection via CRLF sequences (\r\n) in file path parameters passed to high-level path APIs such as cd(), remove(), rename(), uploadFrom(), downloadTo(), list(), and removeDir(). The library's protectWhitespace() helper only handles leading spaces and returns other paths unchanged, while FtpContext.send() writes the resulting command string directly to the control socket with \r\n appended. This lets attacker-controlled path strings split one intended FTP command into multiple commands. This vulnerability is fixed in 5.2.1.
CVSS metrics
7 scores · 7 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated8.6HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L
- OSV · DebianEcosystem advisory · calculated8.6HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L
- OSV · WolfiEcosystem advisory · calculated8.6HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L
- OSV · NpmEcosystem advisory · calculated8.6HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L
- OSV · ChainguardEcosystem advisory · calculated8.6HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L
- NVDNIST8.6HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L
EPSS trend
Probability
2.19%
Chance of exploitation in the next 30 days
Percentile
82%
Versus all other CVEs
30-day change
Decrease -0.62 pp
From 2.80% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundBasic Ftp
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Chainguard25 products
- code-server< 4.112.0-r3
- kibana-8.17< 8.17.10-r17
- kibana-8.17-bitnami< 8.17.10-r17
- kibana-8.17-iamguarded< 8.17.10-r17
- kibana-8.19< 8.19.14-r2
Wolfi3 products
- code-server< 4.112.0-r3
- langfuse-3-worker< 3.164.0-r5
- opensearch-dashboards-3-security-dashboards-plugin< 3.5.0-r15
Debian1 product
- node-proxy-agentsAll versions (No fix recorded) | < 0~2025070717+~cs15.3.7-1
Npm1 product
- basic-ftp≥ 5.2.0, < 5.2.1
Patrickjuchli1 product
- basic-ftp< 5.2.1
Ubuntu1 product
- node-proxy-agentsAll versions (No fix recorded)
6 vendors · 32 products
References
14 links- github.com/patrickjuchli/basic-ftp/security/advisories/GHSA-chqc-8p9q-pq6qX Refsource CONFIRMREPORTAdvisoryWEBExploitMitigationVendor Advisory
- github.com/patrickjuchli/basic-ftp/commit/2ecc8e2c500c5234115f06fd1dbde1aa03d70f4bX Refsource MISCREPORTFIXWEBPatch
