CVE-2026-39983

Full vulnerability record from the local CVENow database.
Description

basic-ftp is an FTP client for Node.js. Prior to 5.2.1, basic-ftp allows FTP command injection via CRLF sequences (\r\n) in file path parameters passed to high-level path APIs such as cd(), remove(), rename(), uploadFrom(), downloadTo(), list(), and removeDir(). The library's protectWhitespace() helper only handles leading spaces and returns other paths unchanged, while FtpContext.send() writes the resulting command string directly to the control socket with \r\n appended. This lets attacker-controlled path strings split one intended FTP command into multiple commands. This vulnerability is fixed in 5.2.1.
Severity
HIGH
CVSS score
8.6 (v3.1)
Vulnerability status
Modified
Source identifier
[email protected]
Published
2026-04-09 18:17:02.503000
Last modified
2026-10-26 22:10:00.163000
View original CVE JSON
{
  "id": "CVE-2026-39983",
  "sourceIdentifier": "[email protected]",
  "published": "2026-04-09T18:17:02.503",
  "lastModified": "2026-10-26T22:10:00.163",
  "vulnStatus": "Modified",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "basic-ftp is an FTP client for Node.js. Prior to 5.2.1, basic-ftp allows FTP command injection via CRLF sequences (\\r\\n) in file path parameters passed to high-level path APIs such as cd(), remove(), rename(), uploadFrom(), downloadTo(), list(), and removeDir(). The library's protectWhitespace() helper only handles leading spaces and returns other paths unchanged, while FtpContext.send() writes the resulting command string directly to the control socket with \\r\\n appended. This lets attacker-controlled path strings split one intended FTP command into multiple commands. This vulnerability is fixed in 5.2.1."
    },
    {
      "lang": "es",
      "value": "basic-ftp es un cliente FTP para Node.js. Antes de la 5.2.1, basic-ftp permite la inyección de comandos FTP a través de secuencias CRLF (\\r\\n) en parámetros de ruta de archivo pasados a APIs de ruta de alto nivel como cd(), remove(), rename(), uploadFrom(), downloadTo(), list() y removeDir(). El ayudante protectWhitespace() de la biblioteca solo maneja espacios iniciales y devuelve otras rutas sin cambios, mientras que FtpContext.send() escribe la cadena de comando resultante directamente al socket de control con \\r\\n añadido. Esto permite que las cadenas de ruta controladas por el atacante dividan un comando FTP previsto en múltiples comandos. Esta vulnerabilidad se corrige en la 5.2.1."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "patrickjuchli",
          "product": "basic-ftp",
          "versions": [
            {
              "version": "< 5.2.1",
              "status": "affected"
            }
          ]
        }
      ]
    },
    {
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
      "affectedData": [
        {
          "vendor": "Red Hat",
          "product": "Red Hat Developer Hub 1.8",
          "defaultStatus": "affected",
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "packageName": "rhdh/rhdh-hub-rhel9",
          "cpes": [
            "cpe:/a:redhat:rhdh:1.8::el9"
          ],
          "versions": [
            {
              "version": "1776784286",
              "lessThan": "*",
              "versionType": "rpm",
              "status": "unaffected"
            }
          ]
        },
        {
          "vendor": "Red Hat",
          "product": "Red Hat Developer Hub 1.9",
          "defaultStatus": "affected",
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "packageName": "rhdh/rhdh-hub-rhel9",
          "cpes": [
            "cpe:/a:redhat:rhdh:1.9::el9"
          ],
          "versions": [
            {
              "version": "1777903262",
              "lessThan": "*",
              "versionType": "rpm",
              "status": "unaffected"
            }
          ]
        },
        {
          "vendor": "Red Hat",
          "product": "Red Hat OpenShift AI (RHOAI)",
          "defaultStatus": "unaffected",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "packageName": "rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9",
          "cpes": [
            "cpe:/a:redhat:openshift_ai"
          ]
        },
        {
          "vendor": "Red Hat",
          "product": "Red Hat OpenShift Container Platform 4",
          "defaultStatus": "affected",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "packageName": "redhat-user-workloads/art-images",
          "cpes": [
            "cpe:/a:redhat:openshift:4"
          ]
        },
        {
          "vendor": "Red Hat",
          "product": "Self-service automation portal 2",
          "defaultStatus": "affected",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "packageName": "redhat-user-workloads/ansible-plugins",
          "cpes": [
            "cpe:/a:redhat:ansible_portal:2"
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L",
          "baseScore": 8.6,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "HIGH",
          "availabilityImpact": "LOW"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 4.7
      },
      {
        "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L",
          "baseScore": 8.6,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "HIGH",
          "availabilityImpact": "LOW"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 4.7
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-04-09T17:32:54.638105Z",
          "id": "CVE-2026-39983",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-93"
        }
      ]
    },
    {
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-93"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:patrickjuchli:basic-ftp:*:*:*:*:*:node.js:*:*",
              "versionEndExcluding": "5.2.1",
              "matchCriteriaId": "C779DF66-693E-4EB3-B33E-AC0A43741872"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/patrickjuchli/basic-ftp/commit/2ecc8e2c500c5234115f06fd1dbde1aa03d70f4b",
      "source": "[email protected]",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://github.com/patrickjuchli/basic-ftp/releases/tag/v5.2.1",
      "source": "[email protected]",
      "tags": [
        "Product",
        "Release Notes"
      ]
    },
    {
      "url": "https://github.com/patrickjuchli/basic-ftp/security/advisories/GHSA-chqc-8p9q-pq6q",
      "source": "[email protected]",
      "tags": [
        "Exploit",
        "Mitigation",
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:13826",
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:9742",
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
    },
    {
      "url": "https://access.redhat.com/security/cve/CVE-2026-39983",
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
    },
    {
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456971",
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
    },
    {
      "url": "https://github.com/patrickjuchli/basic-ftp/security/advisories/GHSA-chqc-8p9q-pq6q",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Exploit",
        "Mitigation",
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39983.json",
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
    }
  ]
}