Basic FTP has Path Traversal Vulnerability in its downloadToDir() method
Summary
Basic FTP has Path Traversal Vulnerability in its downloadToDir() method
Original description
The description as published by the source.
The basic-ftp FTP client library for Node.js contains a path traversal vulnerability (CWE-22) in versions prior to 5.2.0 in the downloadToDir() method. A malicious FTP server can send directory listings with filenames containing path traversal sequences (../) that cause files to be written outside the intended download directory. Version 5.2.0 patches the issue.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2026-27699 node-proxy-agents Fixed in: 0~2024040606-6+deb13u1
- Ubuntu UBUNTU-CVE-2026-27699 node-proxy-agents
References
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- patch github.com
- web github.com