Read the docs
TI-2020-16120 Aliases CVE-2020-26299GHSA-pmw4-jgxx-pcq9

File System Bounds Escape

Priority MEDIUM 45CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.

Summary

ftp-srv is an open-source FTP server designed to be simple yet configurable. In ftp-srv before version 4.4.0 there is a path-traversal vulnerability. Clients of FTP servers utilizing ftp-srv hosted on Windows machines can escape the FTP user's defined root folder using the expected FTP commands, for example, CWD and UPDR. When windows separators exist within the path (`\`), `path.resolve` leaves the upper pointers intact and allows the user to move beyond the root folder defined for that user. We did not take that into account when creating the path resolve function. The issue is patched in version 4.4.0 (commit 457b859450a37cba10ff3c431eb4aa67771122e3).

Why it matters now

EPSS 0.01886 79th percentileScored 2026-11-07
Public exploit Yes 3 exploit referencesTagged by NVD
Fix Fixed ftp-srv (autovance): 4.4.0ftp-srv (npm): 4.4.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
autovanceftp-srvbefore 4.4.04.4.0Patch availableCNA
—ftp-srv (npm)before 4.4.04.4.0Patch availableGHSA-pmw4-jgxx-pcq9
  • ftp-srv Vendorautovance Affected before 4.4.0 Fixed in 4.4.0 Patch available CNA
  • ftp-srv (npm) Vendor— Affected before 4.4.0 Fixed in 4.4.0 Patch available GHSA-pmw4-jgxx-pcq9

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:ftp-srv_project:ftp-srv:*:*:*:*:*:node.js:*:*before 4.4.0VulnerableFtp-srv Project
  • cpe:2.3:a:ftp-srv_project:ftp-srv:*:*:*:*:*:node.js:*:* Versions before 4.4.0 Vulnerable ·Ftp-srv Project

Remediation

  • Fix · CNA ftp-srv (autovance) Fixed in 4.4.0
  • Fix · GHSA-pmw4-jgxx-pcq9 ftp-srv (npm) Fixed in 4.4.0 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat Openshift Container Storage 4

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-26299
  2. 2026-10-03 Alias added: GHSA-pmw4-jgxx-pcq9

References

Exploit 3

Patch 2

Advisory 2

  • TI-2020-11924 Server-Side Request Forgery in ftp-srv CVSS 3.1CRITICAL 9.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences