Cloudanix VulnDB

CVE-2026-27699

Critical · 9.1

CVSS

9.1

EPSS

1.0%

Published

Feb 25, 2026

CISA due date

—

The record

The `basic-ftp` FTP client library for Node.js contains a path traversal vulnerability (CWE-22) in versions prior to 5.2.0 in the `downloadToDir()` method. A malicious FTP server can send directory listings with filenames containing path traversal sequences (`../`) that cause files to be written outside the intended download directory. Version 5.2.0 patches the issue.

Affected packages

Ecosystem Package Introduced Fixed
npm basic-ftp 0 5.2.0
Chainguard code-server 0 4.106.3-r6
Chainguard kibana-8.17 0 8.17.10-r11
Chainguard kibana-8.17-iamguarded 0 8.17.10-r11
Chainguard kibana-8.19 0 8.19.12-r1
Chainguard kibana-8.19-bitnami 0 8.19.12-r1
Chainguard kibana-8.19-iamguarded 0 8.19.12-r1
Chainguard kibana-9.0 0 9.0.8-r11
Chainguard kibana-9.0-bitnami 0 9.0.8-r11
Chainguard kibana-9.0-iamguarded 0 9.0.8-r11
Chainguard kibana-9.1 0 9.1.10-r6
Chainguard kibana-9.1-iamguarded 0 9.1.10-r6
Chainguard kibana-9.2 0 9.2.5-r5
Chainguard kibana-9.2-iamguarded 0 9.2.5-r5
Chainguard kibana-9.3 0 9.3.0-r2
Chainguard kibana-9.3-iamguarded 0 9.3.0-r2
Chainguard langfuse-2-worker 0 2.95.12-r12
Chainguard langfuse-3-worker 0 3.155.1-r3
Chainguard langfuse-fips-2-worker 0 2.95.12-r15
Chainguard langfuse-fips-3-worker 0 3.155.1-r3
Chainguard opensearch-dashboards-2-fips-security-dashboards-plugin 0 2.19.4-r12
Chainguard opensearch-dashboards-2-security-dashboards-plugin 0 2.19.4-r12
Chainguard opensearch-dashboards-3-fips-security-dashboards-plugin 0 3.5.0-r2
Chainguard opensearch-dashboards-3-security-dashboards-plugin 0 3.5.0-r4
Wolfi code-server 0 4.106.3-r6
Wolfi langfuse-3-worker 0 3.155.1-r3
Wolfi opensearch-dashboards-2-security-dashboards-plugin 0 2.19.4-r12
Wolfi opensearch-dashboards-3-security-dashboards-plugin 0 3.5.0-r4

Related vulnerabilities