CVE-2026-27699: Basic FTP Path Traversal Vulnerability in downloadToDir() Method
Summary
CVE-2026-27699: Basic FTP has Path Traversal Vulnerability in its downloadToDir() method. Affects basic-ftp versions < 5.2.0. Fixed in 5.2.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The 'basic-ftp' library is a popular Node.js package that facilitates FTP client functionality, allowing users to interact with FTP servers for file transfers. It is widely used for its simplicity and ease of integration in applications that require FTP capabilities. However, it has been identified to contain a critical path traversal vulnerability that can be exploited by malicious FTP servers.
Vulnerability Detail
The basic-ftp library has a path traversal vulnerability in its downloadToDir() method. This vulnerability arises when a malicious FTP server sends directory listings containing filenames with path traversal sequences (e.g., '../'). The library's parser fails to adequately validate these filenames, allowing files to be written outside the intended download directory. As a result, an attacker could potentially overwrite critical system files or gain unauthorized access to sensitive data, leading to severe security implications, including remote code execution.
How To Fix
Latest published version: 6.2.3 as of 23 Oct 2026
npm install basic-ftp@6.2.3Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
5.2.0
This is the first release that contains the fix.
npm install basic-ftp@5.2.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the downloadToDir() method with untrusted FTP servers to mitigate the risk of exploitation.
Conclusion
The basic-ftp library contains a critical path traversal vulnerability that can be exploited by malicious FTP servers. It is essential to update to version 5.2.0 or later to mitigate this risk. Additionally, implementing filename sanitization in your code can further enhance security.
See every vulnerability recorded for basic-ftp →
FAQ
The vulnerability is a path traversal issue that allows files to be written outside the intended directory, potentially leading to overwriting critical system files.
You can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities. Check your application against this vulnerability using the Vulert playground at Vulert Scanner.
The CVSS score of this vulnerability is 9.1, indicating a critical severity level.
If you cannot update the package, refrain from using the downloadToDir() method with untrusted FTP servers as a temporary measure.
Yes, all versions of basic-ftp prior to 5.2.0 are likely affected by this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for basic-ftp.
