Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.1
CVE-2026-27699: basic-ftp package can let attackers run code
CVE-2026-27699 · published 16 days ago
Summary
The basic-ftp library used in several Node.js projects can be manipulated to execute malicious code on the server. This could let an attacker take control of the system or steal data. Update to the latest patched version of basic-ftp as soon as possible to close the risk.
What to do
- Update patrickjuchli basic-ftp to version 5.2.0.
- Update rootio @rootio/basic-ftp to version 5.0.3-root.io.2.
- Update rootio @rootio/basic-ftp to version 5.0.3-root.io.3.
- Update debian node-proxy-agents to version 0~2024040606-6+deb13u1.
- Update debian node-proxy-agents to version 0~2025070717+~cs15.2.7-1.
- Update rootio @rootio/basic-ftp to version 5.0.3-root.io.4.
- Update rootio @rootio/basic-ftp to version 5.2.0-root.io.4.
- Update patrickjuchli basic-ftp to version 5.2.0-aikido.4.
- Update basic-ftp to version 5.2.0-aikido.4.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| npm | patrickjuchli | basic-ftp |
< 5.2.0 Fix: upgrade to 5.2.0
|
| – | patrickjuchli | basic-ftp |
< 5.2.0 cpe:2.3:a:patrickjuchli:basic-ftp:*:*:*:*:*:node.js:*:* |
| Root:npm | rootio | @rootio/basic-ftp |
< 5.0.3-root.io.2 < 5.0.3-root.io.3 < 5.0.3-root.io.4 < 5.2.0-root.io.4 Fix: upgrade to 5.0.3-root.io.2
|
| Debian:13 | debian | node-proxy-agents |
< 0~2024040606-6+deb13u1 Fix: upgrade to 0~2024040606-6+deb13u1
|
| Debian:14 | debian | node-proxy-agents |
< 0~2025070717+~cs15.2.7-1 Fix: upgrade to 0~2025070717+~cs15.2.7-1
|
| Root:npm | patrickjuchli | basic-ftp |
< 5.2.0-aikido.4 Fix: upgrade to 5.2.0-aikido.4
|
| Root:npm | – | basic-ftp |
< 5.2.0-aikido.4 Fix: upgrade to 5.2.0-aikido.4
|
Original advisory text
CVE-2026-27699 in basic-ftp - Patched by Root
Root has patched CVE-2026-27699 in the basic-ftp package for Root:npm. Multiple fixed versions available.
References
- https://github.com/patrickjuchli/basic-ftp/security/advisories/GHSA-5rq4-664w-9x... Exploit Vendor Advisory Mitigation
- https://nvd.nist.gov/vuln/detail/CVE-2026-27699
- https://github.com/advisories/GHSA-5rq4-664w-9x2c
- https://github.com/patrickjuchli/basic-ftp/commit/2a2a0e6514357b9eda07c2f8afbd3f... Patch
- https://github.com/patrickjuchli/basic-ftp/releases/tag/v5.2.0 Release Notes
- https://security-tracker.debian.org/tracker/CVE-2026-27699 Vendor Advisory
Severity
9.1
Critical
CVSS 3.1: 9.8 (NVD)
CVSS 3.1: 9.8 (OSV)
Exploitation
EPSS 1%
Type
CWE-22Path Traversal
Timeline
Published9 Sep 2026
Updated25 Sep 2026
First seen6 Mar 2026
Track software like this
Free during beta