CVE-2026-27699
Fixed in a distro release EPSS <1%CVSS 9.1
The `basic-ftp` FTP client library for Node.js contains a path traversal vulnerability (CWE-22) in versions prior to 5.2.0 in the `downloadToDir()` method. A malicious FTP server can send directory listings with filenames containing path traversal sequences (`../`) that cause files to be written outside the intended download directory. Version 5.2.0 patches the issue.
Products: patrickjuchli basic-ftp
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| npm | basic-ftp | 5.2.0 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | code-server | 4.106.3-r6 |
| Chainguard | kibana-7 | no fix |
| Chainguard | kibana-8.17 | 8.17.10-r11 |
| Chainguard | kibana-8.17-iamguarded | 8.17.10-r11 |
| Chainguard | kibana-8.18 | no fix |
| Chainguard | kibana-8.18-bitnami | no fix |
| Chainguard | kibana-8.18-iamguarded | no fix |
| Chainguard | kibana-8.19 | 8.19.12-r1 |
| Chainguard | kibana-8.19-bitnami | 8.19.12-r1 |
| Chainguard | kibana-8.19-iamguarded | 8.19.12-r1 |
| Chainguard | kibana-9.0 | 9.0.8-r11 |
| Chainguard | kibana-9.0-bitnami | 9.0.8-r11 |
| Chainguard | kibana-9.0-iamguarded | 9.0.8-r11 |
| Chainguard | kibana-9.1 | 9.1.10-r6 |
| Chainguard | kibana-9.1-iamguarded | 9.1.10-r6 |
| Chainguard | kibana-9.2 | 9.2.5-r5 |
| Chainguard | kibana-9.2-iamguarded | 9.2.5-r5 |
| Chainguard | kibana-9.3 | 9.3.0-r2 |
| Chainguard | kibana-9.3-iamguarded | 9.3.0-r2 |
| Chainguard | langfuse-2-worker | 2.95.12-r12 |
| Chainguard | langfuse-3-worker | 3.155.1-r3 |
| Chainguard | langfuse-fips-2-worker | 2.95.12-r15 |
| Chainguard | langfuse-fips-3-worker | 3.155.1-r3 |
| Chainguard | opensearch-dashboards-2-fips-security-dashboards-plugin | 2.19.4-r12 |
| Chainguard | opensearch-dashboards-2-security-dashboards-plugin | 2.19.4-r12 |
| Chainguard | opensearch-dashboards-3-fips-security-dashboards-plugin | 3.5.0-r2 |
| Chainguard | opensearch-dashboards-3-security-dashboards-plugin | 3.5.0-r4 |
| Debian 13 | node-proxy-agents | 0~2024040606-6+deb13u1 |
| Debian 14 | node-proxy-agents | 0~2025070717+~cs15.2.7-1 |
| Ubuntu 24.04 LTS | node-proxy-agents | no fix |
| Ubuntu 25.10 | node-proxy-agents | no fix |
| Ubuntu 26.04 LTS | node-proxy-agents | no fix |
| Ubuntu 26.10 | node-proxy-agents | no fix |
| Wolfi | code-server | 4.106.3-r6 |
| Wolfi | langfuse-3-worker | 3.155.1-r3 |
| Wolfi | opensearch-dashboards-3-security-dashboards-plugin | 3.5.0-r4 |
| openSUSE Tumbleweed | agama-integration-tests | 1785848065.5562c7c-4.1 |