Critical severity · published Feb 25, 2026
CVE-2026-27699
Basic FTP has Path Traversal Vulnerability in its downloadToDir() method
9.8
CVSS
0.9%
EPSS
No
On KEV
Description
The `basic-ftp` FTP client library for Node.js contains a path traversal vulnerability (CWE-22) in versions prior to 5.2.0 in the `downloadToDir()` method. A malicious FTP server can send directory listings with filenames containing path traversal sequences (`../`) that cause files to be written outside the intended download directory. Version 5.2.0 patches the issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 61% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BA
basic-ftp · patrickjuchli
< 5.2.0 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-27699
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-27699
Patch
https://github.com/patrickjuchli/basic-ftp/commit/2a2a0e6514357b9eda07c2f8afbd3f04727a7cd9
Release Notes
https://github.com/patrickjuchli/basic-ftp/releases/tag/v5.2.0
Exploit
https://github.com/patrickjuchli/basic-ftp/security/advisories/GHSA-5rq4-664w-9x2c
More from basic-ftp
8.6
CVE-2026-39983
FTP Command Injection via CRLF in basic-ftp
8.2
CVE-2026-102990
basic-ftp: Quadratic-time CPU denial of service in Client.list() Unix directory-listing parser (RE_LINE backtracking)
7.5
CVE-2026-44240
basic-ftp allows a malicious FTP server to cause client-side denial of service via unbounded multiline control response buffering
7.5
CVE-2026-41324
basic-ftp vulnerable to denial of service via unbounded memory consumption in Client.list()