CVE-2026-39983highCWE-93

CVE-2026-39983: fallo de gravedad alta en patrickjuchli basic-ftp

FTP Command Injection via CRLF in basic-ftp

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear basic-ftp+ Monitorear node-proxy-agents

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 8.6epss 2.2%
basic-ftp is an FTP client for Node.js. Prior to 5.2.1, basic-ftp allows FTP command injection via CRLF sequences (\r\n) in file path parameters passed to high-level path APIs such as cd(), remove(), rename(), uploadFrom(), downloadTo(), list(), and removeDir(). The library's protectWhitespace() helper only handles leading spaces and returns other paths unchanged, while FtpContext.send() writes the resulting command string directly to the control socket with \r\n appended. This lets attacker-controlled path strings split one intended FTP command into multiple commands. This vulnerability is fixed in 5.2.1.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L
Productos afectados
patrickjuchli · basic-ftp
CVEs relacionadas — patrickjuchli basic-ftp

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-27699CRITICALBasic FTP has Path Traversal Vulnerability in its downloadToDir() methodEPSS 0.9%CVE-2026-44240HIGHbasic-ftp allows a malicious FTP server to cause client-side denial of service via unbounded multiline control response bufferingEPSS 0.5%CVE-2026-102990HIGHbasic-ftp: Quadratic-time CPU denial of service in Client.list() Unix directory-listing parser (RE_LINE backtracking)EPSS 0.4%CVE-2026-41324HIGHbasic-ftp vulnerable to denial of service via unbounded memory consumption in Client.list()EPSS 0.3%