# CVE-2026-27699: basic-ftp path traversal in downloadToDir

Source: https://junglewise.ai/threats/cve-2026-27699-basic-ftp-path-traversal-in-downloadtodir  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-02-25. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-27699 · Severity: low · CVSS 3.1 · Published 2026-02-25

The basic-ftp library is a Node.js FTP client used to download files from FTP servers. A malicious FTP server can craft directory listings with specially crafted filenames containing path traversal sequences (like ../../../) that cause files to be written outside the intended download directory, potentially overwriting critical system files or enabling remote code execution if the application has sufficient file permissions.

Technologies: [basic-ftp (npm)](https://junglewise.ai/threats/technologies/basic-ftp). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-27699 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-27699 being exploited in the wild.

**How severe is CVE-2026-27699?** Low severity, with a CVSS score of 3.1, published 25 February 2026.

**Which products and versions are affected?** basic-ftp (npm) SEMVER:introduced=0,fixed=5.2.0.

**Is there a fix for CVE-2026-27699?** Yes. basic-ftp (npm): upgrade to 5.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-27699 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-27699?** Check whether you run basic-ftp (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- basic-ftp (npm): upgrade to 5.2.0 or later

  ```sh
  npm install basic-ftp@5.2.0
  ```


## Technical details

The vulnerability exists in the downloadToDir() method (Client.ts:707) where filenames received from an untrusted FTP server are used directly in path construction without proper sanitization. The parser validation in parseListUnix.ts:101 only filters exact "." and ".." entries but does not prevent sequences like "../../../etc/passwd". When combined with path.join(), which does not prevent traversal resolution, and fs.open() which resolves paths, an attacker-controlled FTP server can write files to arbitrary locations on the client filesystem. Attack vector requires the client application to call downloadToDir() against a malicious FTP server; no authentication or user interaction is needed. The fix, released in v5.2.0, sanitizes filenames using path.basename() to strip path components before writing.

## Affected products

- patrickjuchli basic-ftp < 5.2.0

## Identifiers

- CVE-2026-27699
- GHSA-5rq4-664w-9x2c

## Timeline

- 2026-02-25: disclosed: Vulnerability published in GHSA-5rq4-664w-9x2c
- 2026-02-23: patched: Fixed in version 5.2.0 with filename sanitization

## References

- [https://github.com/patrickjuchli/basic-ftp/security/advisories/GHSA-5rq4-664w-9x2c](https://github.com/patrickjuchli/basic-ftp/security/advisories/GHSA-5rq4-664w-9x2c)
- [https://github.com/patrickjuchli/basic-ftp/commit/2a2a0e6514357b9eda07c2f8afbd3f04727a7cd9](https://github.com/patrickjuchli/basic-ftp/commit/2a2a0e6514357b9eda07c2f8afbd3f04727a7cd9)
- [https://github.com/patrickjuchli/basic-ftp](https://github.com/patrickjuchli/basic-ftp)
- [https://github.com/patrickjuchli/basic-ftp/releases/tag/v5.2.0](https://github.com/patrickjuchli/basic-ftp/releases/tag/v5.2.0)

## Related threats

- [basic-ftp unhandled exception in control socket event handler](https://junglewise.ai/threats/cve-2026-126346-basic-ftp-uncaught-exception-crashes-the-node-js-process-when-a)
- [basic-ftp MLSD parser prototype pollution](https://junglewise.ai/threats/cve-2026-126345-basic-ftp-uncaught-typeerror-in-mlsd-directory-listing-parser)
- [basic-ftp quadratic-time denial of service in Client.list()](https://junglewise.ai/threats/cve-2026-102990-basic-ftp-is-an-ftp-client-for-node-js-prior-to-6-2-1-client)
- [basic-ftp denial of service via unbounded multiline response buffering](https://junglewise.ai/threats/cve-2026-44240-basic-ftp-denial-of-service-via-unbounded-multiline-control)
- [basic-ftp vulnerable to denial of service via unbounded memory consumption in Client.list()](https://junglewise.ai/threats/cve-2026-41324-basic-ftp-vulnerable-to-denial-of-service-via-unbounded-memory)