CVE-2026-27699
The FTP client library for Node.js contains a path traversal vulnerability (CWE-22) in versions prior to 5.2.0 in the method.
Published Feb 25, 2026 · updated Jun 17, 2026 · patrickjuchli basic-ftp
The FTP client library for Node.js contains a path traversal vulnerability (CWE-22) in versions prior to 5.2.0 in the method. A malicious FTP server can send directory listings with filenames containing path traversal sequences ( ) that cause files to be written outside the intended download directory. Version 5.2.0 patches the issue.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Feb 25, 2026 · NIST NVD
Detected
The FTP client library for Node.js contains a path traversal vulnerability (CWE-22) in versions prior to 5.2.0 in the method. A malicious FTP server can send directory listings with filenames containing path traversal sequences ( ) that cause files to be written outside the intended download directory. Version 5.2.0 patches the issue.
Jun 17, 2026 · NIST NVD
Updated
The FTP client library for Node.js contains a path traversal vulnerability (CWE-22) in versions prior to 5.2.0 in the method. A malicious FTP server can send directory listings with filenames containing path traversal sequences ( ) that cause files to be written outside the intended download directory. Version 5.2.0 patches the issue.
Affected
- cpe patrickjuchli/basic-ftpversion unspecified
Sources
- NIST NVDVulnerability recordCVE-2026-27699
The FTP client library for Node.js contains a path traversal vulnerability (CWE-22) in versions prior to 5.2.0 in the method. A malicious FTP server can send directory listings with filenames containing path traversal sequences ( ) that cause fil
nvd.nist.gov