Is CVE-2026-27699 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-27699 being exploited in the wild.

How severe is CVE-2026-27699?

Low severity, with a CVSS score of 3.1, published 25 February 2026.

Which products and versions are affected?

basic-ftp (npm) SEMVER:introduced=0,fixed=5.2.0.

Is there a fix for CVE-2026-27699?

Yes. basic-ftp (npm): upgrade to 5.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-27699 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-27699?

Check whether you run basic-ftp (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-27699: basic-ftp path traversal in downloadToDir

CVE-2026-27699 · Severity: low · CVSS 3.1 · Published 2026-02-25

The basic-ftp library is a Node.js FTP client used to download files from FTP servers. A malicious FTP server can craft directory listings with specially crafted filenames containing path traversal sequences (like ../../../) that cause files to be written outside the intended download directory, potentially overwriting critical system files or enabling remote code execution if the application has sufficient file permissions.

Technologies: basic-ftp (npm). Vendors: npm.

Quick answers

Is CVE-2026-27699 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-27699 being exploited in the wild.
How severe is CVE-2026-27699?: Low severity, with a CVSS score of 3.1, published 25 February 2026.
Which products and versions are affected?: basic-ftp (npm) SEMVER:introduced=0,fixed=5.2.0.
Is there a fix for CVE-2026-27699?: Yes. basic-ftp (npm): upgrade to 5.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-27699 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-27699?: Check whether you run basic-ftp (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

basic-ftp (npm): upgrade to 5.2.0 or later
```
npm install basic-ftp@5.2.0
```

Technical details

The vulnerability exists in the downloadToDir() method (Client.ts:707) where filenames received from an untrusted FTP server are used directly in path construction without proper sanitization. The parser validation in parseListUnix.ts:101 only filters exact "." and ".." entries but does not prevent sequences like "../../../etc/passwd". When combined with path.join(), which does not prevent traversal resolution, and fs.open() which resolves paths, an attacker-controlled FTP server can write files to arbitrary locations on the client filesystem. Attack vector requires the client application to call downloadToDir() against a malicious FTP server; no authentication or user interaction is needed. The fix, released in v5.2.0, sanitizes filenames using path.basename() to strip path components before writing.

Affected products

patrickjuchli basic-ftp < 5.2.0

Identifiers

CVE-2026-27699
GHSA-5rq4-664w-9x2c

Timeline

2026-02-25: disclosed: Vulnerability published in GHSA-5rq4-664w-9x2c
2026-02-23: patched: Fixed in version 5.2.0 with filename sanitization

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.