The `basic-ftp` FTP client library for Node.js contains a path traversal vulnerability (CWE-22) in versions prior to 5.2.0 in the `downloadToDir()` method. A malicious FTP server can send directory listings with filenames containing path traversal sequences (`../`) that cause files to be written outside the intended download directory. Version 5.2.0 patches the issue.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - The `basic-ftp` FTP client library for Node.js contains a path traversal vulnerability (CWE-22) in
    versions prior to 5.2.0 in the `downloadToDir()` method. A malicious FTP server can send directory
    listings with filenames containing path traversal sequences (`../`) that cause files to be written outside
    the intended download directory. Version 5.2.0 patches the issue. (CVE-2026-27699)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The `basic-ftp` FTP client library for Node.js contains a path traversal vulnerability (CWE-22) in     versions prior to 5.2.0 in the `downloadToDir()` method. A malicious FTP server can send directory     listings with filenames containing path traversal sequences (`../`) that cause files to be written outside     the intended download directory. Version 5.2.0 patches the issue. (CVE-2026-27699)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
459599	Echo: basic-ftp: security update to 0~2025070717+~cs15.2.7-1	Tenable Cloud Security	Echo Local Security Checks	Local	critical
459599	Echo: basic-ftp: security update to 0~2025070717+~cs15.2.7-1	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	critical
438095	SCA: security update for basic-ftp (GHSA-5rq4-664w-9x2c)	Tenable Cloud Security	SCA Checks	Local	critical
438095	SCA: security update for basic-ftp (GHSA-5rq4-664w-9x2c)	Tenable Self-Hosted Container Security	SCA Checks	Local	critical
300394	Linux Distros Unpatched Vulnerability : CVE-2026-27699	Nessus	Misc.	Local	critical

Detections

Analytics

CVE-2026-27699

critical

Tenable Plugins

critical

critical

critical

critical

critical