{"action":"Upgrade basic-ftp to 5.2.0 or later.","affected":[{"fixed":"5.2.0","introduced":"0"}],"component":"basic-ftp","cve_ids":["CVE-2026-27699"],"ecosystem":"npm","epss":0.00939,"exploited":false,"fixed_versions":["5.2.0"],"ghsa_id":"GHSA-5rq4-664w-9x2c","id":"tcs_01M5KF4MAPT3T9D3DSA4KT2AFE","modified_at":"2026-09-10T03:50:34.155700781Z","published_at":"2026-02-25T22:34:26Z","references":["https://osv.dev/vulnerability/GHSA-5rq4-664w-9x2c","https://github.com/patrickjuchli/basic-ftp/security/advisories/GHSA-5rq4-664w-9x2c","https://nvd.nist.gov/vuln/detail/CVE-2026-27699","https://github.com/patrickjuchli/basic-ftp/commit/2a2a0e6514357b9eda07c2f8afbd3f04727a7cd9","https://github.com/patrickjuchli/basic-ftp","https://github.com/patrickjuchli/basic-ftp/releases/tag/v5.2.0"],"severity":{"label":"critical","score":9.1},"sources":[{"source":"osv","source_id":"GHSA-5rq4-664w-9x2c","url":"https://osv.dev/vulnerability/GHSA-5rq4-664w-9x2c"}],"summary":"Basic FTP has Path Traversal Vulnerability in its downloadToDir() method"}