CVE-2026-39983highCWE-93

CVE-2026-39983: high-severity vulnerability in patrickjuchli basic-ftp

FTP Command Injection via CRLF in basic-ftp

Published · Updated

Follow this CVE+ Monitor basic-ftp+ Monitor node-proxy-agents

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.6epss 2.2%
basic-ftp is an FTP client for Node.js. Prior to 5.2.1, basic-ftp allows FTP command injection via CRLF sequences (\r\n) in file path parameters passed to high-level path APIs such as cd(), remove(), rename(), uploadFrom(), downloadTo(), list(), and removeDir(). The library's protectWhitespace() helper only handles leading spaces and returns other paths unchanged, while FtpContext.send() writes the resulting command string directly to the control socket with \r\n appended. This lets attacker-controlled path strings split one intended FTP command into multiple commands. This vulnerability is fixed in 5.2.1.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L
Affected products
patrickjuchli · basic-ftp
Related CVEs — patrickjuchli basic-ftp

In the same product, most dangerous first.

CVE-2026-27699CRITICALBasic FTP has Path Traversal Vulnerability in its downloadToDir() methodEPSS 0.9%CVE-2026-44240HIGHbasic-ftp allows a malicious FTP server to cause client-side denial of service via unbounded multiline control response bufferingEPSS 0.5%CVE-2026-102990HIGHbasic-ftp: Quadratic-time CPU denial of service in Client.list() Unix directory-listing parser (RE_LINE backtracking)EPSS 0.4%CVE-2026-41324HIGHbasic-ftp vulnerable to denial of service via unbounded memory consumption in Client.list()EPSS 0.3%