CVE-2026-27699
📋 TL;DR
The basic-ftp Node.js library contains a path traversal vulnerability in the downloadToDir() method. A malicious FTP server can send filenames containing '../' sequences, causing files to be written outside the intended download directory. This affects all applications using basic-ftp versions prior to 5.2.0 for FTP client operations.
💻 Affected Systems
- basic-ftp Node.js library
📦 What is this software?
Basic Ftp by Patrickjuchli
⚠️ Risk & Real-World Impact
Worst Case
Arbitrary file overwrite on the client system, potentially leading to remote code execution, data destruction, or privilege escalation if critical system files are overwritten.
Likely Case
Unauthorized file writes to arbitrary locations on the client filesystem, potentially overwriting application files, configuration files, or user data.
If Mitigated
Files written to unintended but non-critical directories, causing data integrity issues but no system compromise.
🎯 Exploit Status
Exploitation requires a malicious FTP server that the client connects to. No authentication is needed on the client side.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 5.2.0
Vendor Advisory: https://github.com/patrickjuchli/basic-ftp/security/advisories/GHSA-5rq4-664w-9x2c
Restart Required: No
Instructions:
1. Update basic-ftp dependency to version 5.2.0 or later. 2. Run 'npm update basic-ftp' or update package.json to '^5.2.0'. 3. Test application functionality with updated library.
🔧 Temporary Workarounds
Avoid downloadToDir() method
allUse alternative methods for FTP downloads that don't have the vulnerability
Validate FTP server trust
allOnly connect to trusted FTP servers
🧯 If You Can't Patch
- Implement input validation/sanitization for filenames received from FTP servers
- Run the application with minimal filesystem permissions and in isolated environments
🔍 How to Verify
Check if Vulnerable:
Check package.json or node_modules for basic-ftp version. If version is <5.2.0 and application uses downloadToDir(), it's vulnerable.Check Version:
npm list basic-ftpVerify Fix Applied:
Confirm basic-ftp version is 5.2.0 or higher in package.json and node_modules.📡 Detection & Monitoring
Log Indicators:
- Unexpected file writes outside download directory
- FTP download errors with path traversal patterns
Network Indicators:
- Connections to unknown/untrusted FTP servers
- FTP directory listings containing '../' sequences
SIEM Query:
File creation events where path contains '../' patterns from Node.js processes