CVE-2026-27699 Basic FTP has Path Traversal Vulnerability in its downloadToDir() method
A malicious FTP server can write files outside the intended directory via path traversal in the basic-ftp library's downloadToDir method.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-27699?
CVE-2026-27699 is a critical path traversal vulnerability in patrickjuchli basic-ftp, published on 25 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The `basic-ftp` FTP client library for Node.js contains a path traversal vulnerability (CWE-22) in versions prior to 5.2.0 in the `downloadToDir()` method. A malicious FTP server can send directory listings with filenames containing path traversal sequences (`../`) that cause files to be written outside the intended download directory. Version 5.2.0 patches the issue.
Weakness: CWE-22
Which versions are affected by CVE-2026-27699?
2 open source packages ship an affected version, including basic-ftp. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
basic-ftp npm | All versions | 5.2.0 |
basic-ftp npm | All versions | 5.2.0 |
Products include Patrickjuchli Basic-Ftp.
How do I fix CVE-2026-27699?
Upgrade basic-ftp to 5.2.0 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-27699 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-27699 exists.
Other vulnerabilities in patrickjuchli basic-ftp
Sources
Also known as DEBIAN-CVE-2026-27699, ECHO-1bbc-f7da-7503, GHSA-5rq4-664w-9x2c, MINI-28vx-rvq4-85rf, MINI-4wfh-jq59-hwpr, MINI-5wgj-3wjf-ff6w and 13 more.