CVE-2026-27699: 
JavaScript vulnerability analysis and mitigation

CVE-2026-27699 is a path traversal vulnerability (CWE-22) in the basic-ftp FTP client library for Node.js, affecting all versions prior to 5.2.0. The flaw resides in the downloadToDir() method, which fails to sanitize filenames received from FTP servers, allowing a malicious FTP server to write files outside the intended download directory. It was first published by the maintainer on February 23, 2026, and added to the NVD on February 25, 2026. The CVSS v3.1 base score is 9.1 (Critical) per the GitHub Advisory, though some sources (Feedly/NVD) report 9.8 (GitHub Advisory, Red Hat Bugzilla).

The root cause is insufficient input validation in src/parseListUnix.ts (line 101), which only filters filenames that are exactly . or .., allowing traversal sequences such as ../../../etc/passwd to pass unchecked. In src/Client.ts (line 707), the _downloadFromWorkingDir() method constructs a local file path using path.join(localDirPath, file.name) without sanitization; since Node.js's path.join() does not prevent traversal, the resolved path can escape the intended directory. The file is then opened for writing via fsOpen(localPath, 'w'), completing the write to an arbitrary location. The fix in commit 2a2a0e6 adds a check using basename(file.name) !== file.name to skip any filename containing path components (GitHub Advisory, Patch Commit).

A malicious FTP server can exploit this vulnerability to write arbitrary files to any location accessible by the Node.js process running the basic-ftp client, without requiring any user interaction or authentication. This can result in overwriting critical system files (e.g., /etc/passwd, SSH authorized keys, application configuration), injecting malicious code into web roots or startup scripts, and potentially achieving remote code execution if writable paths include executable locations. Integrity and availability are both rated High; confidentiality impact is assessed as None by the GitHub Advisory (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H), though some sources assign a higher confidentiality impact (GitHub Advisory, Red Hat Bugzilla).

A proof-of-concept demonstrating the vulnerability is publicly available via the GitHub security advisory, and the exploit flow is fully documented with a source-to-sink trace. As of the disclosure date, there is no evidence of active in-the-wild exploitation. The EPSS score is approximately 0.041%–0.152% (36th percentile), indicating a low but non-negligible probability of exploitation in the near term. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no threat actor attribution has been reported (GitHub Advisory, Feedly).

1. Set up a malicious FTP server: Configure a rogue FTP server (e.g., using Python's pyftpdlib or a custom implementation) that responds to LIST commands with directory entries containing path traversal sequences in filenames, such as ../../../etc/cron.d/backdoor or ../../../home/user/.ssh/authorized_keys.
2. Craft the malicious LIST response: When the client issues a LIST command, respond with a Unix-format directory listing entry like: -rw-r--r-- 1 user group 1024 Jan 20 12:00 ../../../etc/passwd. The filename passes the library's weak filter (which only blocks exact . or .. matches).
3. Trigger downloadToDir(): Ensure the victim Node.js application calls client.downloadToDir(localPath) against the malicious server. This can occur when an application connects to an external or user-supplied FTP server and downloads a directory.
4. Exploit path traversal: The library constructs path.join('/safe/download', '../../../etc/passwd'), which resolves to /etc/passwd. The file is opened with write mode (fsOpen(localPath, 'w')) and the attacker-controlled content is written to the target path.
5. Achieve objective: Depending on the process's permissions, the attacker can overwrite system files, plant SSH keys, inject cron jobs, or write web shells to achieve persistence or remote code execution (GitHub Advisory, Patch Commit).

• Logs: Node.js application logs showing FTP LIST responses containing filenames with ../ sequences; after patching to v5.2.0, log entries such as Invalid filename from server listing, will skip file. ("../../../etc/passwd") indicate attempted exploitation.
• File System: Unexpected new or modified files in sensitive directories (e.g., /etc/, /home/*/.ssh/, /var/spool/cron/, web root directories) with timestamps correlating to FTP download operations; files owned by the Node.js service account in unusual locations.
• Network: Outbound FTP connections (TCP port 21 or passive data ports) to unknown or untrusted IP addresses from application servers; FTP data channel transfers delivering content to paths outside the configured download directory.
• Process: Node.js processes writing to file paths outside expected application directories, observable via auditd or inotifywait monitoring on sensitive directories (GitHub Advisory).

Upgrade basic-ftp to version 5.2.0 or later, which skips files with invalid names (those where basename(file.name) !== file.name) in downloadToDir() and logs a warning instead of writing the file. As an immediate workaround for applications that cannot be patched immediately, avoid using downloadToDir() with untrusted or externally controlled FTP servers; alternatively, implement manual filename sanitization using basename(file.name) before constructing local paths. IBM has issued advisories for affected products including Instana (OnPrem), IBM Bob, QRadar Suite Software, and Aspera Enterprise WebApps, and users of those products should apply the respective IBM security bulletins (GitHub Release v5.2.0, IBM Instana Advisory, IBM Aspera Advisory).

The vulnerability was reported by researcher "thecasual" and disclosed via the GitHub Security Advisory program on February 23, 2026. Security news outlets including SecurityOnline.info and TheHackerWire covered the disclosure, characterizing it as a critical flaw exposing Node.js applications to arbitrary file writes. Red Hat tracked the issue in Bugzilla (Bug 2442644) with high severity, and IBM issued multiple security bulletins for downstream products. Community reaction on Mastodon and Bluesky highlighted the risk to applications connecting to untrusted FTP servers (SecurityOnline, TheHackerWire, Red Hat Bugzilla).