CVE-2026-27699

The CVE affects the Node.js FTP client library basic-ftp prior to version 5.2.0, where the downloadToDir() method is vulnerable to a path traversal (CWE-22). A malicious FTP server can emit directory listings containing filenames with traversal sequences ("../"), causing files to be written outsi...