Executive brief
The basic-ftp library is a Node.js FTP client used to download files from FTP servers. A malicious FTP server can craft directory listings with specially crafted filenames containing path traversal sequences (like ../../../) that cause files to be written outside the intended download directory, potentially overwriting critical system files or enabling remote code execution if the application has sufficient file permissions.
Technical details
The vulnerability exists in the downloadToDir() method (Client.ts:707) where filenames received from an untrusted FTP server are used directly in path construction without proper sanitization. The parser validation in parseListUnix.ts:101 only filters exact "." and ".." entries but does not prevent sequences like "../../../etc/passwd". When combined with path.join(), which does not prevent traversal resolution, and fs.open() which resolves paths, an attacker-controlled FTP server can write files to arbitrary locations on the client filesystem. Attack vector requires the client application to call downloadToDir() against a malicious FTP server; no authentication or user interaction is needed. The fix, released in v5.2.0, sanitizes filenames using path.basename() to strip path components before writing.
Affected products
- patrickjuchli basic-ftp < 5.2.0
Timeline
- 2026-02-25: disclosed: Vulnerability published in GHSA-5rq4-664w-9x2c
- 2026-02-23: patched: Fixed in version 5.2.0 with filename sanitization