The basic-ftp Node.js library contains a path traversal flaw in its downloadToDir() method, allowing a malicious FTP server to supply directory listings with filenames that include traversal sequences such as ../. When the client processes these listings, the files are written outside the intended download directory, potentially overwriting system files or creating arbitrary files. This flaw could compromise the integrity and confidentiality of the file system on the client machine, with a severity score of 9.1 on the CVSS scale.

Vulnerable occur in all versions of basic-ftp prior to 5.2.0. The affected product is the Node.js FTP client library maintained by patrickjuchli. Any Node.js application that imports basic-ftp and invokes downloadToDir() against an FTP server is at risk; the library has been widely used in management tooling and automation scripts.

The condition for exploitation requires the attacker to control or manipulate the FTP server’s directory listings sent to the client. As the EPSS score is below 1%, the observed exploitation likelihood is currently low, but the high CVSS score and the absence of the vulnerability from the CISA KEV list suggest it is a critical vulnerability that could become targeted as interest grows. Remote attackers can trigger the flaw remotely by simply hosting an FTP service that serves malicious listings; no local code execution is required beyond the library’s standard use.