Vulnerability	Vulnerable Version
C CRLF Injection basic-ftp is a FTP client for Node.js, supports FTPS over TLS, IPv6, Async/Await, and Typescript. Affected versions of this package are vulnerable to CRLF Injection via unsanitized path parameters in the `protectWhitespace` function. An attacker can execute arbitrary FTP commands by injecting CRLF sequences into file path inputs, which are then interpreted as separate commands by the FTP server. This can lead to unauthorized file deletion, directory manipulation, file exfiltration, command execution on supporting servers, session hijacking, or service disruption. How to fix CRLF Injection? Upgrade `basic-ftp` to version 5.2.1 or higher.	<5.2.1
H Directory Traversal basic-ftp is a FTP client for Node.js, supports FTPS over TLS, IPv6, Async/Await, and Typescript. Affected versions of this package are vulnerable to Directory Traversal in the `downloadToDir()` method. A malicious FTP server can overwrite or create files outside the intended directory. How to fix Directory Traversal? Upgrade `basic-ftp` to version 5.2.0 or higher.	<5.2.0

CRLF Injection

basic-ftp is a FTP client for Node.js, supports FTPS over TLS, IPv6, Async/Await, and Typescript.

Affected versions of this package are vulnerable to CRLF Injection via unsanitized path parameters in the protectWhitespace function. An attacker can execute arbitrary FTP commands by injecting CRLF sequences into file path inputs, which are then interpreted as separate commands by the FTP server. This can lead to unauthorized file deletion, directory manipulation, file exfiltration, command execution on supporting servers, session hijacking, or service disruption.

How to fix CRLF Injection?

Upgrade basic-ftp to version 5.2.1 or higher.

<5.2.1

Directory Traversal

basic-ftp is a FTP client for Node.js, supports FTPS over TLS, IPv6, Async/Await, and Typescript.

Affected versions of this package are vulnerable to Directory Traversal in the downloadToDir() method. A malicious FTP server can overwrite or create files outside the intended directory.

How to fix Directory Traversal?

Upgrade basic-ftp to version 5.2.0 or higher.

<5.2.0

Go back to all versions of this package