CVE-2026-39983highCWE-93

CVE-2026-39983: falha de alta gravidade em patrickjuchli basic-ftp

FTP Command Injection via CRLF in basic-ftp

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar basic-ftp+ Monitorar node-proxy-agents

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.6epss 2.2%
basic-ftp is an FTP client for Node.js. Prior to 5.2.1, basic-ftp allows FTP command injection via CRLF sequences (\r\n) in file path parameters passed to high-level path APIs such as cd(), remove(), rename(), uploadFrom(), downloadTo(), list(), and removeDir(). The library's protectWhitespace() helper only handles leading spaces and returns other paths unchanged, while FtpContext.send() writes the resulting command string directly to the control socket with \r\n appended. This lets attacker-controlled path strings split one intended FTP command into multiple commands. This vulnerability is fixed in 5.2.1.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L
Produtos afetados
patrickjuchli · basic-ftp
CVEs relacionadas — patrickjuchli basic-ftp

No mesmo produto, das mais perigosas para as menos.

CVE-2026-27699CRITICALBasic FTP has Path Traversal Vulnerability in its downloadToDir() methodEPSS 0.9%CVE-2026-44240HIGHbasic-ftp allows a malicious FTP server to cause client-side denial of service via unbounded multiline control response bufferingEPSS 0.5%CVE-2026-102990HIGHbasic-ftp: Quadratic-time CPU denial of service in Client.list() Unix directory-listing parser (RE_LINE backtracking)EPSS 0.4%CVE-2026-41324HIGHbasic-ftp vulnerable to denial of service via unbounded memory consumption in Client.list()EPSS 0.3%