Basic FTP has Path Traversal Vulnerability in its downloadToDir() method
Résumé
Basic FTP has Path Traversal Vulnerability in its downloadToDir() method
Description d'origine
La description telle que publiée par la source (souvent en anglais).
The basic-ftp FTP client library for Node.js contains a path traversal vulnerability (CWE-22) in versions prior to 5.2.0 in the downloadToDir() method. A malicious FTP server can send directory listings with filenames containing path traversal sequences (../) that cause files to be written outside the intended download directory. Version 5.2.0 patches the issue.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
État des correctifs par distribution
Paquets corrigés publiés par chaque distribution pour cette CVE
- Debian DEBIAN-CVE-2026-27699 node-proxy-agents Corrigé dans: 0~2024040606-6+deb13u1
- Ubuntu UBUNTU-CVE-2026-27699 node-proxy-agents
Références
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- patch github.com
- web github.com