Basic FTP has Path Traversal Vulnerability in its downloadToDir() method

The `basic-ftp` FTP client library for Node.js contains a path traversal vulnerability (CWE-22) in versions prior to 5.2.0 in the `downloadToDir()` method. A malicious FTP server can send directory listings with filenames containing path traversal sequences (`../`) that cause files to be written outside the intended download directory. Version 5.2.0 patches the issue.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

对路径名的限制不恰当(路径遍历)

Basic FTP 路径遍历漏洞

Basic FTP是Patrick Juchli个人开发者的一个Node.js的FTP客户端库。 basic ftp 5.2.0之前版本存在路径遍历漏洞，该漏洞源于downloadToDir()方法中存在路径遍历漏洞，恶意FTP服务器可发送包含路径遍历序列的文件名目录列表，导致文件被写入预期下载目录之外。

N/A

N/A