CVE-2026-27699

Publication date 26 February 2026

Last updated 27 February 2026

Ubuntu priority

Medium

Why this priority?

Cvss 3 Severity Score

9.1 · Critical

Score breakdown

Description

The `basic-ftp` FTP client library for Node.js contains a path traversal vulnerability (CWE-22) in versions prior to 5.2.0 in the `downloadToDir()` method. A malicious FTP server can send directory listings with filenames containing path traversal sequences (`../`) that cause files to be written outside the intended download directory. Version 5.2.0 patches the issue.

Read the notes from the security team

Status

Package Ubuntu Release Status
node-proxy-agents 25.10 questing
Needs evaluation
24.04 LTS noble
Needs evaluation
22.04 LTS jammy Not in release

Notes

rodrigo-zaiden

basic-ftp in included in node-proxy-agents

Severity score breakdown

Parameter Value
Base score 9.1 · Critical
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Scope Unchanged
Confidentiality None
Integrity impact High
Availability impact High
Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

References

Other references