Junglewise Threat Intelligence

CVE-2026-39983: patrickjuchli basic-ftp FTP command injection via CRLF sequences

CVE-2026-39983 · Severity: high · CVSS 8.6 · Published 2026-04-09

Technologies: Red Hat Self-service automation portal, Red Hat Self-service automation portal 2, basic-ftp (npm), Red Hat Developer Hub. Vendors: Red Hat, npm.

Executive brief

basic-ftp is a software library used by Node.js applications to transfer files via the FTP protocol. A vulnerability in this library allows an attacker to inject unauthorized commands into an FTP session if the application uses untrusted user input for file paths. This could lead to unauthorized file deletion, data theft, or the creation of malicious directories on the connected FTP server.

Technical details

A CRLF injection vulnerability exists in basic-ftp prior to version 5.2.1. The library's protectWhitespace() helper fails to sanitize carriage return (\r) and line feed (\n) characters in path parameters, while the FtpContext.send() method appends its own CRLF and writes directly to the control socket. An attacker providing a crafted path string can split a single intended FTP command into multiple commands. This allows for the execution of arbitrary FTP commands such as DELE, RETR, or MKD. The vulnerability affects high-level APIs including cd(), remove(), rename(), uploadFrom(), downloadTo(), list(), and removeDir(). The issue is fixed in version 5.2.1 by rejecting paths containing control characters.

Affected products

  • patrickjuchli basic-ftp < 5.2.1
  • Red Hat Red Hat Developer Hub 1.8 affected
  • Red Hat Red Hat Developer Hub 1.9 affected
  • Red Hat Red Hat OpenShift Container Platform 4 affected
  • Red Hat Self-service automation portal 2 affected

Timeline

  • 2026-04-08: patched: Version 5.2.1 released to address the vulnerability.
  • 2026-04-09: disclosed: Vulnerability disclosed via GitHub Security Advisory.
  • 2026-04-09: advisory: NVD published CVE-2026-39983.

References

Related threats