CVE-2026-27699 is a critical path traversal (CVSS 9.1) in basic-ftp, the Node.js FTP client. A malicious FTP server can send file names that make downloadToDir() write outside the chosen directory. Applications that call that method against servers they do not control are the ones at risk. Upgrade basic-ftp to 5.2.0 or later.
What's affected
The npm package basic-ftp before 5.2.0. The flaw is in the downloadToDir() method. Applications that only upload, or that download single named files with their own local path, are not on this code path.
The advisory page lists the affected range as below 5.1.0 while the NVD record says before 5.2.0. The fix is in 5.2.0 either way, so upgrade to 5.2.0 or later.
The risk depends on trusting the server. A client that only talks to FTP servers you control carries less risk than one that connects to servers chosen by users or third parties.
How to check if you're exposed
Find the package in your dependency tree, including copies pulled in by other tools.
npm ls basic-ftp --all
npm why basic-ftp
Then search your code for the method.
grep -rn "downloadToDir" src/
If you find both a vulnerable version and a call to downloadToDir, you are in scope. A scan that checks whether the vulnerable function is called is the quickest way to rank it. You can also paste a manifest into the free in-browser dependency scan.
What to do now
- Upgrade basic-ftp to 5.2.0 or later and rebuild your lockfile.
- For indirect copies, update the parent package or use an override.
- Only connect to FTP servers you trust, or run the transfer in a sandboxed directory with limited privileges.
- After a download from an untrusted server, check for files outside the target directory.
- Consider moving to SFTP where the server supports it, though that does not change this fix.
Why it matters
This is CWE-22, path traversal. The advisory traces the flow. The server sends a directory listing, the parser filters only the exact entries for the current and parent directory, and the client then joins the listed name with the local folder. A name that contains parent directory segments passes the check and resolves outside the folder.
The unusual part is the direction. Most path traversal bugs let a client attack a server. Here the server attacks the client, using data the client was never expected to distrust. File names from a remote listing are untrusted input like any other.
With write access to arbitrary paths, the consequences include overwriting configuration or startup files. The record scores integrity and availability impact high and confidentiality none.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does this affect uploads?
The advisory describes the downloadToDir() method. Check the advisory if you use other download paths.
Sources
Last reviewed: 19 October 2026.
