CVE-2026-27699: Basic FTP has Path Traversal Vulnerability in its downloadToDir() method
The basic-ftp library contains a path traversal vulnerability in the downloadToDir() method. A malicious FTP server can send directory listings with filenames containing path traversal sequences (../) that cause files to be written outside the intended download directory.
References
- github.com/advisories/GHSA-5rq4-664w-9x2c
- github.com/patrickjuchli/basic-ftp
- github.com/patrickjuchli/basic-ftp/commit/2a2a0e6514357b9eda07c2f8afbd3f04727a7cd9
- github.com/patrickjuchli/basic-ftp/releases/tag/v5.2.0
- github.com/patrickjuchli/basic-ftp/security/advisories/GHSA-5rq4-664w-9x2c
- nvd.nist.gov/vuln/detail/CVE-2026-27699
Code Behaviors & Features
Detect and mitigate CVE-2026-27699 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →