Basic FTP has Path Traversal Vulnerability in its downloadToDir() method

🗓️ 25 Feb 2026 22:34:26Reported by GitHub Advisory DatabaseType

github

github🔗 github.com👁 8 Views

Path traversal in the downloadToDir method allows an FTP server to write outside download directory.

Reporter	Title	Published	Views	Family All 43
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM Aspera Enterprise WebApps	29 May 202618:08	–	ibm
IBM Security Bulletins	Security Bulletin: MongoDB Enterprised Advanced affected by: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CVE-2026-27699)	11 May 202618:21	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise Certified Container flows that use the Box or Databricks connectors are vulnerable to loss of confidentiality (CVE-2026-27699)	31 Mar 202615:02	–	ibm
ATTACKERKB	CVE-2026-27699	25 Feb 202614:58	–	attackerkb
Information Security Automation	March Linux Patch Wednesday	30 Mar 202620:00	–	avleonov
Chainguard	CVE-2026-27699 vulnerabilities	28 Feb 202601:17	–	cgr
Circl	CVE-2026-27699	25 Feb 202617:56	–	circl
CNNVD	Basic FTP 路径遍历漏洞	25 Feb 202600:00	–	cnnvd
CVE	CVE-2026-27699	25 Feb 202614:58	–	cve
Cvelist	CVE-2026-27699 Basic FTP has Path Traversal Vulnerability in its downloadToDir() method	25 Feb 202614:58	–	cvelist

Vulners

Node

patrickjuchli basic-ftpRange<5.2.0npm

Source	Link
github	www.github.com/patrickjuchli/basic-ftp/security/advisories/GHSA-5rq4-664w-9x2c
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-27699
github	www.github.com/patrickjuchli/basic-ftp/commit/2a2a0e6514357b9eda07c2f8afbd3f04727a7cd9
github	www.github.com/patrickjuchli/basic-ftp/releases/tag/v5.2.0
github	www.github.com/advisories/GHSA-5rq4-664w-9x2c

25 Feb 2026 22:34Current

6Medium risk

Vulners AI Score6

CVSS 3.19.1 - 9.8

EPSS0.00152

SSVC

path traversal vulnerability download directory method file transfer protocol untrusted filename sanitization missing