The vulnerability of the downloadToDir() function in the FTP-client library of the Node.js software platform, which allows a hacker to execute arbitrary code.

🗓️ 01 Apr 2026 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 3 Views

DownloadToDir in the Node.js FTP client library has a path restriction flaw enabling remote code execution.

Reporter	Title	Published	Views	Family All 45
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM Aspera Enterprise WebApps	29 May 202618:08	–	ibm
IBM Security Bulletins	Security Bulletin: MongoDB Enterprised Advanced affected by: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CVE-2026-27699)	11 May 202618:21	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise Certified Container flows that use the Box or Databricks connectors are vulnerable to loss of confidentiality (CVE-2026-27699)	31 Mar 202615:02	–	ibm
ATTACKERKB	CVE-2026-27699	25 Feb 202614:58	–	attackerkb
Information Security Automation	March Linux Patch Wednesday	30 Mar 202620:00	–	avleonov
Chainguard	CVE-2026-27699 vulnerabilities	28 Feb 202601:17	–	cgr
Circl	CVE-2026-27699	25 Feb 202617:56	–	circl
CNNVD	Basic FTP 路径遍历漏洞	25 Feb 202600:00	–	cnnvd
CVE	CVE-2026-27699	25 Feb 202614:58	–	cve
Cvelist	CVE-2026-27699 Basic FTP has Path Traversal Vulnerability in its downloadToDir() method	25 Feb 202614:58	–	cvelist

Source	Link
github	www.github.com/patrickjuchli/basic-ftp/security/advisories/GHSA-5rq4-664w-9x2c
github	www.github.com/patrickjuchli/basic-ftp/releases/tag/v5.2.0
web	www.web.nvd.nist.gov/view/vuln/detail

01 Apr 2026 00:00Current

6.1Medium risk

Vulners AI Score6.1

CVSS 39.8

CVSS 210

EPSS0.00528

downloadToDir node javascript file transfer protocol path restriction flaw remote code execution