{"id":"EUVD-2026-20976","enisaUuid":"78b3dae4-be26-3cd2-ba18-432d37151421","description":"basic-ftp is an FTP client for Node.js. Prior to 5.2.1, basic-ftp allows FTP command injection via CRLF sequences (\\r\\n) in file path parameters passed to high-level path APIs such as cd(), remove(), rename(), uploadFrom(), downloadTo(), list(), and removeDir(). The library\u0027s protectWhitespace() helper only handles leading spaces and returns other paths unchanged, while FtpContext.send() writes the resulting command string directly to the control socket with \\r\\n appended. This lets attacker-controlled path strings split one intended FTP command into multiple commands. This vulnerability is fixed in 5.2.1.","datePublished":"Apr 9, 2026, 5:05:46 PM","dateUpdated":"Jul 15, 2026, 1:01:38 AM","baseScore":8.6,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L","references":"https://github.com/patrickjuchli/basic-ftp/security/advisories/GHSA-chqc-8p9q-pq6q\nhttps://github.com/patrickjuchli/basic-ftp/commit/2ecc8e2c500c5234115f06fd1dbde1aa03d70f4b\nhttps://github.com/patrickjuchli/basic-ftp/releases/tag/v5.2.1\n","aliases":"CVE-2026-39983\n","assigner":"GitHub_M","epss":2.19,"enisaIdProduct":[{"id":"5d8556e4-949c-343f-b204-80a45aa4838d","product":{"name":"basic-ftp","vendor":{"name":"patrickjuchli"}},"product_version":"\u003c 5.2.1"}],"enisaIdVendor":[{"id":"be842e07-647d-34a4-9f37-1014924c0b39","vendor":{"name":"patrickjuchli"}}],"enisaIdVulnerability":[{"id":"f29d70b1-4631-3b5b-8efd-e5e9cd7c7ea5","vulnerability":{"id":"CVE-2026-39983","description":"basic-ftp is an FTP client for Node.js. Prior to 5.2.1, basic-ftp allows FTP command injection via CRLF sequences (\\r\\n) in file path parameters passed to high-level path APIs such as cd(), remove(), rename(), uploadFrom(), downloadTo(), list(), and removeDir(). The library\u0027s protectWhitespace() helper only handles leading spaces and returns other paths unchanged, while FtpContext.send() writes the resulting command string directly to the control socket with \\r\\n appended. This lets attacker-controlled path strings split one intended FTP command into multiple commands. This vulnerability is fixed in 5.2.1.","datePublished":"Apr 9, 2026, 5:05:46 PM","dateUpdated":"Jul 15, 2026, 1:01:38 AM","status":"PUBLISHED","baseScore":8.6,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L","references":"https://github.com/patrickjuchli/basic-ftp/security/advisories/GHSA-chqc-8p9q-pq6q\nhttps://github.com/patrickjuchli/basic-ftp/commit/2ecc8e2c500c5234115f06fd1dbde1aa03d70f4b\nhttps://github.com/patrickjuchli/basic-ftp/releases/tag/v5.2.1\n","enisa_id":"EUVD-2026-20976\n","assigner":"GitHub_M","epss":2.19,"dataProcessed":"Oct 30, 2026, 7:13:03 AM","vulnerabilityProduct":[{"id":"84389beb-eb44-315d-8d1c-f61cd299d6c1","product":{"name":"basic-ftp","vendor":{"name":"patrickjuchli"}},"product_version":"\u003c 5.2.1"}],"vulnerabilityVendor":[{"id":"3b253ac9-922b-3032-ace2-0e70be5b7ad7","vendor":{"name":"patrickjuchli"}}]}}],"enisaIdAdvisory":[{"id":"04e78c1c-b7df-3919-aaea-571117b5f941","advisory":{"id":"RHSA-2026:9742","description":"Red Hat Security Advisory: Red Hat Developer Hub 1.8.6 release.","summary":"Red Hat Developer Hub 1.8.6 has been released.","datePublished":"Apr 22, 2026, 2:56:38 PM","dateUpdated":"Oct 23, 2026, 4:55:37 AM","baseScore":0.0,"references":"https://access.redhat.com/errata/RHSA-2026:9742\nhttps://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_9742.json\n","aliases":"CVE-2025-62718\nCVE-2025-69534\nCVE-2025-69873\nCVE-2026-1525\nCVE-2026-1526\nCVE-2026-1528\nCVE-2026-2229\nCVE-2026-3118\nCVE-2026-4800\nCVE-2026-4926\nCVE-2026-25679\nCVE-2026-26996\nCVE-2026-27601\nCVE-2026-27904\nCVE-2026-29063\nCVE-2026-29074\nCVE-2026-29186\nCVE-2026-32141\nCVE-2026-33036\nCVE-2026-33228\nCVE-2026-33891\nCVE-2026-33894\nCVE-2026-33895\nCVE-2026-33896\nCVE-2026-39983\nCVE-2026-40175\n","source":{"id":9,"name":"csaf_redhat"},"advisoryProduct":[{"id":"028bad21-4bc7-3e84-9640-0242eba63797","product":{"name":"registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:bb763e2b7a9d101f73b03b9e1c5688e7034fd9d31413e890817bd4098a7d42f9_amd64","vendor":{"name":"Red Hat"}}},{"id":"16e97468-67d9-3fd5-9b5b-6961ea3234f8","product":{"name":"registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:b40f228ed49b81e675763d0bb1e38e7a45c45eef8003237abfbddbfb952bb331_amd64","vendor":{"name":"Red Hat"}}},{"id":"523f9fa5-5136-375e-a90b-06ad6a0cf246","product":{"name":"Red Hat Developer Hub 1.8","vendor":{"name":"Red Hat"}}},{"id":"ecd84c30-9dec-35ae-9049-0d7115795ca4","product":{"name":"registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:f09d63af77eec6b131067a08b1bd3a8c7673f9e68325bfde1ae081f85d73598c_amd64","vendor":{"name":"Red Hat"}}}]}},{"id":"777b2415-2a97-3612-9b68-bed266490e4a","advisory":{"id":"WID-SEC-W-2026-1407","description":"IBM App Connect Enterprise Certified Container: Mehrere Schwachstellen","summary":"Ein Angreifer kann mehrere Schwachstellen in IBM App Connect Enterprise Certified Container ausnutzen, um beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, Cross-Site-Scripting-Angriffe durchzuführen, Daten zu manipulieren, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand zu verursachen.","datePublished":"May 6, 2026, 10:00:00 PM","dateUpdated":"Jul 21, 2026, 10:00:00 PM","baseScore":0.0,"references":"https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-1407.json\nhttps://wid.cert-bund.de/portal/wid/securityadvisory?name\u003dWID-SEC-2026-1407\n","aliases":"CVE-2026-26013\nCVE-2026-27142\nCVE-2026-28277\nCVE-2026-28684\nCVE-2026-32288\nCVE-2026-33151\nCVE-2026-33349\nCVE-2026-33532\nCVE-2026-33891\nCVE-2026-33894\nCVE-2026-33895\nCVE-2026-33896\nCVE-2026-33916\nCVE-2026-34601\nCVE-2026-35469\nCVE-2026-39406\nCVE-2026-39407\nCVE-2026-39408\nCVE-2026-39409\nCVE-2026-39410\nCVE-2026-39983\nCVE-2026-40175\nCVE-2026-40347\nCVE-2026-40895\nCVE-2026-41238\nCVE-2026-41239\nCVE-2026-41240\nCVE-2026-4923\nCVE-2026-4926\n","source":{"id":8,"name":"csaf_certbund"},"advisoryProduct":[{"id":"1da851f2-46b2-3f72-bd8d-c5e540fff7b1","product":{"name":"IBM App Connect Enterprise","vendor":{"name":"IBM"}}},{"id":"1ee0a58b-ee30-38f3-8f79-3f7afdcf6bcc","product":{"name":"13.0.1.0-13.0.7.1","vendor":{"name":"IBM"}}},{"id":"20693e59-f8af-3bfa-811d-66f576b9f01b","product":{"name":"Certified Container Operator 13.1.0","vendor":{"name":"IBM"}}},{"id":"2ea27a91-df29-3e77-8d1e-d5cf6a0af1be","product":{"name":"OpenShift Container Platform 4.20.29","vendor":{"name":"Red Hat"}}},{"id":"4599b3fa-7044-3f98-aba8-96a474e990ef","product":{"name":"12.0.1.0-12.0.12.26","vendor":{"name":"IBM"}}},{"id":"4748ab34-e212-3c92-98f8-75ad8c724243","product":{"name":"Certified Container Operator 12.0.23","vendor":{"name":"IBM"}}},{"id":"487ea5f3-668c-3d1d-b01e-19fcd2e8edf4","product":{"name":"Sterling Connect:Direct","vendor":{"name":"IBM"}}},{"id":"48fc3d55-7560-3485-b1bf-7b93cbfbcaab","product":{"name":"IBM Business Automation Workflow","vendor":{"name":"IBM"}}},{"id":"6b89409c-2713-39f6-ab33-0f0fe83a0554","product":{"name":"Web Services","vendor":{"name":"Oracle Corporation"}}},{"id":"6d548be2-225f-3361-8ef3-9191472ae52f","product":{"name":"Collaboration and Deployment Services","vendor":{"name":"IBM"}}},{"id":"7077353c-0265-37a1-8209-100db8c6f7b4","product":{"name":"IBM QRadar SIEM","vendor":{"name":"IBM"}}},{"id":"763f11a2-f41c-3b1f-b2e9-f0bbaf3a0d14","product":{"name":"App Connect Enterprise","vendor":{"name":"IBM"}}},{"id":"8ed582ca-ad30-34d3-8bab-bede2901affe","product":{"name":"SUSE Linux","vendor":{"name":"SUSE"}}},{"id":"9d55801f-b587-3c77-b2d2-15be18978b7f","product":{"name":"IBM Maximo Asset Management","vendor":{"name":"IBM"}}},{"id":"aa54c55f-7b3a-3292-baf8-7d5eb95bf237","product":{"name":"Enterprise Linux","vendor":{"name":"Red Hat"}}},{"id":"aad28b78-3131-37bd-a45c-c69282a523db","product":{"name":"MQ","vendor":{"name":"IBM"}}},{"id":"af93b134-9f23-3f56-a116-c2f37abda51d","product":{"name":"operator","vendor":{"name":"minio"}}},{"id":"baffe41c-8df9-3046-9dfa-735c68bcbb5f","product":{"name":"SPSS","vendor":{"name":"IBM"}}},{"id":"bc9d8ac9-0456-3d7e-b870-a4e7bac1edfe","product":{"name":"13.0.1.0-13.0.7.0","vendor":{"name":"IBM"}}},{"id":"c3af98cc-cc4a-33e5-8f98-627355517d33","product":{"name":"12.0.1.0-12.0.12.25","vendor":{"name":"IBM"}}},{"id":"d19ede16-7e92-3ca5-b30c-ba57c9353243","product":{"name":"Fedora Linux","vendor":{"name":"Fedora"}}},{"id":"e027ec01-4704-3d40-abc0-ac8f454c9226","product":{"name":"OpenShift","vendor":{"name":"n/a"}}},{"id":"e9ac7cd8-05ee-381a-8f2d-497f6b99ca44","product":{"name":"9 Multicluster Engine for Kubernetes 2.8.6","vendor":{"name":"Red Hat"}}},{"id":"ea35925a-1a5f-3bf4-a795-300f3694f657","product":{"name":"13.0.7.1","vendor":{"name":"IBM"}}},{"id":"fbebe4c7-7861-344a-802e-4cf0ea171ffc","product":{"name":"Red Hat Enterprise Linux","vendor":{"name":"Red Hat"}}}]}},{"id":"af122485-a2ca-3a42-97e9-e55a3ead69ce","advisory":{"id":"RHSA-2026:13826","description":"Red Hat Security Advisory: Red Hat Developer Hub 1.9.4 release.","summary":"Red Hat Developer Hub 1.9.4 has been released.","datePublished":"May 5, 2026, 4:10:46 PM","dateUpdated":"Oct 24, 2026, 7:31:49 AM","baseScore":0.0,"references":"https://access.redhat.com/errata/RHSA-2026:13826\nhttps://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_13826.json\n","aliases":"CVE-2025-62718\nCVE-2025-69534\nCVE-2026-1525\nCVE-2026-1526\nCVE-2026-1528\nCVE-2026-2229\nCVE-2026-3118\nCVE-2026-4800\nCVE-2026-4926\nCVE-2026-27601\nCVE-2026-27904\nCVE-2026-29063\nCVE-2026-29074\nCVE-2026-29186\nCVE-2026-32141\nCVE-2026-32280\nCVE-2026-32282\nCVE-2026-33228\nCVE-2026-33891\nCVE-2026-33894\nCVE-2026-33895\nCVE-2026-33896\nCVE-2026-39983\nCVE-2026-40175\nCVE-2026-40895\n","source":{"id":9,"name":"csaf_redhat"},"advisoryProduct":[{"id":"020794eb-caaf-3b43-a525-6219c4080c7b","product":{"name":"Red Hat Developer Hub 1.9","vendor":{"name":"Red Hat"}}},{"id":"3feb1025-17af-390c-8333-0f541e17beca","product":{"name":"registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:80453720616cee369e9f79863ef1815a2741afdeb25d3572085d11ad54afa9a0_amd64","vendor":{"name":"Red Hat"}}},{"id":"64de241a-3744-37ca-85c0-8c2de3c9e258","product":{"name":"registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:47c3fc5bfb21e980f0fa6c510c48c97982649c7f27d9d486a19391c56c9531ff_amd64","vendor":{"name":"Red Hat"}}},{"id":"a4d142cb-5f51-3cd2-9b62-4ffef6411d9a","product":{"name":"registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:7118207df52574eb4eb9a6b35aa23eef8029937c2ace807b5e132bcc5188a972_amd64","vendor":{"name":"Red Hat"}}}]}}]}