StackRadar

CVE-2026-102990

High

Advisory

Published 30 Sept 2026In the index since 2 Oct 2026
Severity
High
worst across findings
CVSS
8.2
base score, highest
EPSS
0.004
29th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
72
of 18,026 indexed, latest versions
Container images
69
deployed by those charts
Fix available
1 of 2
affected packages

basic-ftp: Quadratic-time CPU denial of service in Client.list() Unix directory-listing parser (RE_LINE backtracking)

Carried by container images the latest versions of 72 of 18,026 indexed charts deploy, on 69 images.

Affected packageAffected versionsFixed inImages
basic-ftpnpm5.0.3, 5.0.4, 5.0.5, 5.1.0+4 more6.2.167
node-proxy-agentsdeb7.1.0~0~2023071921-5, 7.1.1~0~2024040606-6+deb13u1no fix listed3
OSV records
DEBIAN-CVE-2026-102990GHSA-c475-qrg2-pj4rUBUNTU-CVE-2026-102990

Charts affected

72 by stars
ChartLatestAffected imagesRadar Score
backstagebackstageOfficialVerified publisher2.10.21 of 1See more

backstage backstage 2.10.2

1 of the 1 container images this version deploys carry CVE-2026-102990.

Container imageDigestPackageFixed in
ghcr.io/backstage/backstage:lateste2a48bb6ab55
basic-ftp@5.3.1
6.2.1

Open the chart page →

1,330
opensearch-dashboardsopensearch-project-helm-chartsVerified publisher3.9.01 of 1See more

opensearch-dashboards opensearch-project-helm-charts 3.9.0

1 of the 1 container images this version deploys carry CVE-2026-102990.

Container imageDigestPackageFixed in
opensearchproject/opensearch-dashboards:3.9.04bdb8ded547c
basic-ftp@5.3.1
6.2.1

Open the chart page →

312
difydoubanVerified publisher0.10.01 of 6See more

dify douban 0.10.0

1 of the 6 container images this version deploys carry CVE-2026-102990.

Container imageDigestPackageFixed in
langgenius/dify-web:1.10.1-fix.1c306ac577912
basic-ftp@5.0.5
6.2.1

Open the chart page →

82,191
wazuhwazuh-helm-morgovedVerified publisher2.0.71 of 5See more

wazuh wazuh-helm-morgoved 2.0.7

1 of the 5 container images this version deploys carry CVE-2026-102990.

Container imageDigestPackageFixed in
wazuh/wazuh-dashboard:4.14.391e4f0a7feed
basic-ftp@5.0.5
6.2.1

Open the chart page →

13,536
budibasebudibase0.0.0-master2 of 7See more

budibase budibase 0.0.0-master

2 of the 7 container images this version deploys carry CVE-2026-102990.

Container imageDigestPackageFixed in
budibase/apps:3.41.344fe6feab985
basic-ftp@5.3.1
6.2.1
budibase/worker:3.41.3de5e2e560ce8
basic-ftp@5.3.1
6.2.1

Open the chart page →

11,836
krokicowboysysopVerified publisher6.1.04 of 5See more

kroki cowboysysop 6.1.0

4 of the 5 container images this version deploys carry CVE-2026-102990.

Container imageDigestPackageFixed in
yuzutech/kroki-bpmn:0.29.1444805c4b917
basic-ftp@5.0.5
6.2.1
yuzutech/kroki-diagramsnet:0.29.1b810edbf9c62
basic-ftp@5.0.5
6.2.1
yuzutech/kroki-excalidraw:0.29.157917319ea70
basic-ftp@5.0.5
6.2.1
yuzutech/kroki-mermaid:0.29.1963b4acfde6e
basic-ftp@5.0.5
6.2.1

Open the chart page →

8,476
backstagerhdh-chartVerified publisher4.0.11 of 2See more

backstage rhdh-chart 4.0.1

1 of the 2 container images this version deploys carry CVE-2026-102990.

Container imageDigestPackageFixed in
quay.io/rhdh/rhdh-hub-rhel9:latest4f8c0f8a8ee0
basic-ftp@5.3.0
6.2.1

Open the chart page →

1,543
wazuhwazuh-helmVerified publisher0.0.81 of 4See more

wazuh wazuh-helm 0.0.8

1 of the 4 container images this version deploys carry CVE-2026-102990.

Container imageDigestPackageFixed in
wazuh/wazuh-dashboard:4.11.10c58e7b47bb6
basic-ftp@5.0.5
6.2.1

Open the chart page →

7,861
grafana-pdf-exporterwiremindVerified publisher2.1.11 of 1See more

grafana-pdf-exporter wiremind 2.1.1

1 of the 1 container images this version deploys carry CVE-2026-102990.

Container imageDigestPackageFixed in
ghcr.io/wiremind/grafana-pdf-exporter:v1.7dbaa8527bf4c
basic-ftp@5.0.3
6.2.1

Open the chart page →

10,391
codetogethercodetogether1.4.251 of 1See more

codetogether codetogether 1.4.25

1 of the 1 container images this version deploys carry CVE-2026-102990.

Container imageDigestPackageFixed in
codetogether/codetogether:latest4348c8a38752
basic-ftp@5.0.5
6.2.1

Open the chart page →

7,990
rsshubgabe565Verified publisher0.8.01 of 3See more

rsshub gabe565 0.8.0

1 of the 3 container images this version deploys carry CVE-2026-102990.

Container imageDigestPackageFixed in
diygod/rsshub:latestd5fd850a359a
basic-ftp@5.3.1
6.2.1

Open the chart page →

1,812
soketisoketi2.0.01 of 1See more

soketi soketi 2.0.0

1 of the 1 container images this version deploys carry CVE-2026-102990.

Container imageDigestPackageFixed in
quay.io/soketi/soketi:1.6-16-debian713223456cf1
basic-ftp@5.0.3
6.2.1

Open the chart page →

1,891
nocodbzekker6Verified publisher1.10.01 of 1See more

nocodb zekker6 1.10.0

1 of the 1 container images this version deploys carry CVE-2026-102990.

Container imageDigestPackageFixed in
nocodb/nocodb:0.301.5d9516f0bf546
basic-ftp@5.2.0
6.2.1

Open the chart page →

5,210
dawarichcogitriVerified publisher2.9.21 of 3See more

dawarich cogitri 2.9.2

1 of the 3 container images this version deploys carry CVE-2026-102990.

Container imageDigestPackageFixed in
freikin/dawarich:1.15.2e58334ca5697
node-proxy-agents@7.1.1~0~2024040606-6+deb13u1
no fix listed

Open the chart page →

6,974
directusdirectus-io2.1.01 of 3See more

directus directus-io 2.1.0

1 of the 3 container images this version deploys carry CVE-2026-102990.

Container imageDigestPackageFixed in
directus/directus:12.0.29c8470ea465c
basic-ftp@5.3.1
6.2.1

Open the chart page →

9,353
joplin-serverdjjudas21Verified publisher6.0.01 of 1See more

joplin-server djjudas21 6.0.0

1 of the 1 container images this version deploys carry CVE-2026-102990.

Container imageDigestPackageFixed in
joplin/server:3.7.23f7b852959aa
basic-ftp@5.3.1
6.2.1

Open the chart page →

2,964
enbuildenbuildVerified publisher0.0.503 of 6See more

enbuild enbuild 0.0.50

3 of the 6 container images this version deploys carry CVE-2026-102990.

Container imageDigestPackageFixed in
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-backend:1.0.31c7afac3446d6
basic-ftp@5.2.0
6.2.1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-mq-consumer:1.0.310e3cd8c7776d
basic-ftp@5.0.5
6.2.1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-user:1.0.31d8a9cd4e1ae3
basic-ftp@5.2.0
6.2.1

Open the chart page →

35,965
growthbookgrowthbook5.1.01 of 2See more

growthbook growthbook 5.1.0

1 of the 2 container images this version deploys carry CVE-2026-102990.

Container imageDigestPackageFixed in
growthbook/growthbook:5.1.0c8a124f55dca
basic-ftp@5.3.1
6.2.1

Open the chart page →

926
difykubeblocksVerified publisher0.5.11 of 5See more

dify kubeblocks 0.5.1

1 of the 5 container images this version deploys carry CVE-2026-102990.

Container imageDigestPackageFixed in
langgenius/dify-web:0.6.11a2a294743634
basic-ftp@5.0.5
6.2.1

Open the chart page →

22,462
litlyxlitlyx0.2.01 of 5See more

litlyx litlyx 0.2.0

1 of the 5 container images this version deploys carry CVE-2026-102990.

Container imageDigestPackageFixed in
litlyx/litlyx-dashboard:lateste64ff2d52385
basic-ftp@5.0.5
6.2.1

Open the chart page →

9,613
growthbookone-acre-fundVerified publisher0.3.01 of 3See more

growthbook one-acre-fund 0.3.0

1 of the 3 container images this version deploys carry CVE-2026-102990.

Container imageDigestPackageFixed in
growthbook/growthbook:latest67b7cd7d12a1
basic-ftp@5.3.1
6.2.1

Open the chart page →

1,550
portraitportraitVerified publisher0.2.131 of 8See more

portrait portrait 0.2.13

1 of the 8 container images this version deploys carry CVE-2026-102990.

Container imageDigestPackageFixed in
treskon/portrait-ui:DEV-lateste7970783bc8d
basic-ftp@5.2.2
6.2.1

Open the chart page →

36,111
speckle-serverspeckleVerified publisher2.26.31 of 4See more

speckle-server speckle 2.26.3

1 of the 4 container images this version deploys carry CVE-2026-102990.

Container imageDigestPackageFixed in
speckle/speckle-preview-service:2.26.3092384dba45d
basic-ftp@5.0.5
6.2.1

Open the chart page →

11,845
u-storeunifieVerified publisher1.2.01 of 1See more

u-store unifie 1.2.0

1 of the 1 container images this version deploys carry CVE-2026-102990.

Container imageDigestPackageFixed in
public.ecr.aws/g4a0y2u8/unifie-store:staging-19925a2057fabc948
basic-ftp@5.0.5
6.2.1

Open the chart page →

16,602
lhciadnoctemVerified publisher0.1.01 of 1See more

lhci adnoctem 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-102990.

Container imageDigestPackageFixed in
ghcr.io/adnoctem/lhci:1.0.119553e4b4033
basic-ftp@5.3.1
6.2.1

Open the chart page →

1,596
akto-source-code-analyserakto0.1.51 of 3See more

akto-source-code-analyser akto 0.1.5

1 of the 3 container images this version deploys carry CVE-2026-102990.

Container imageDigestPackageFixed in
aktosecurity/akto-puppeteer-replay:doom_latest853e37321e6e
basic-ftp@5.0.5
6.2.1

Open the chart page →

6,053
cloudpremcloudprem0.0.0-build.00306ba7288bb8d46dd8c6190af79ef5b6fbdbad2 of 6See more

cloudprem cloudprem 0.0.0-build.00306ba7288bb8d46dd8c6190af79ef5b6fbdbad

2 of the 6 container images this version deploys carry CVE-2026-102990.

Container imageDigestPackageFixed in
ghcr.io/formancehq/console-v3:v1.16.0c99e8ef2c545
basic-ftp@5.0.5
6.2.1
ghcr.io/formancehq/portal:v1.16.06efef5d19d56
basic-ftp@5.0.5
6.2.1

Open the chart page →

22,248
codehubcodehubVerified publisher6.2.181 of 5See more

codehub codehub 6.2.18

1 of the 5 container images this version deploys carry CVE-2026-102990.

Container imageDigestPackageFixed in
jupyterhub/jupyterhub:5.4.63974ba945e65
node-proxy-agents@7.1.0~0~2023071921-5
no fix listed

Open the chart page →

14,892
dev-code-servercosmoVerified publisher0.0.71 of 2See more

dev-code-server cosmo 0.0.7

1 of the 2 container images this version deploys carry CVE-2026-102990.

Container imageDigestPackageFixed in
ghcr.io/cosmo-workspace/dev-code-server:v0.0.316fda01ae58a
basic-ftp@5.0.5
6.2.1

Open the chart page →

16,312
decisionrules-aksdecisionrules-aksVerified publisher0.3.01 of 2See more

decisionrules-aks decisionrules-aks 0.3.0

1 of the 2 container images this version deploys carry CVE-2026-102990.

Container imageDigestPackageFixed in
decisionrules/server:latestbb3a93224b5a
basic-ftp@5.3.1
6.2.1

Open the chart page →

458
decisionrules-eksdecisionrules-eksVerified publisher0.4.01 of 2See more

decisionrules-eks decisionrules-eks 0.4.0

1 of the 2 container images this version deploys carry CVE-2026-102990.

Container imageDigestPackageFixed in
decisionrules/server:latestbb3a93224b5a
basic-ftp@5.3.1
6.2.1

Open the chart page →

458
decisionrules-ingressdecisionrules-ingressVerified publisher0.3.01 of 2See more

decisionrules-ingress decisionrules-ingress 0.3.0

1 of the 2 container images this version deploys carry CVE-2026-102990.

Container imageDigestPackageFixed in
decisionrules/server:latestbb3a93224b5a
basic-ftp@5.3.1
6.2.1

Open the chart page →

458
decisionrules-ocpdecisionrules-ocpVerified publisher0.2.01 of 4See more

decisionrules-ocp decisionrules-ocp 0.2.0

1 of the 4 container images this version deploys carry CVE-2026-102990.

Container imageDigestPackageFixed in
decisionrules/server:latestbb3a93224b5a
basic-ftp@5.3.1
6.2.1

Open the chart page →

1,506
difydify1.0.01 of 4See more

dify dify 1.0.0

1 of the 4 container images this version deploys carry CVE-2026-102990.

Container imageDigestPackageFixed in
langgenius/dify-web:1.0.0d64914ff0d6d
basic-ftp@5.0.5
6.2.1

Open the chart page →

56,689
directusdirectusVerified publisher0.9.101 of 4See more

directus directus 0.9.10

1 of the 4 container images this version deploys carry CVE-2026-102990.

Container imageDigestPackageFixed in
directus/directus:11.1.0e3c8bb975350
basic-ftp@5.0.5
6.2.1

Open the chart page →

5,437
dumpstoredumpstore0.1.11 of 2See more

dumpstore dumpstore 0.1.1

1 of the 2 container images this version deploys carry CVE-2026-102990.

Container imageDigestPackageFixed in
ghcr.io/manzil-infinity180/backend-dumpstore:226f28ca3efa6d3691044813cd09085e28d4a7b496c90cf82fdd
basic-ftp@5.0.5
6.2.1

Open the chart page →

5,081
facetflanksourceVerified publisher0.1.731 of 1See more

facet flanksource 0.1.73

1 of the 1 container images this version deploys carry CVE-2026-102990.

Container imageDigestPackageFixed in
ghcr.io/flanksource/facet:0.1.73a0323f4283e5
basic-ftp@5.3.1
6.2.1

Open the chart page →

24,132
geomapfishgeomapfish0.8.01 of 3See more

geomapfish geomapfish 0.8.0

1 of the 3 container images this version deploys carry CVE-2026-102990.

Container imageDigestPackageFixed in
camptocamp/geomapfishapp-geoportal:latestae874f70cc16
basic-ftp@5.3.1
node-proxy-agents@7.1.0~0~2023071921-5
6.2.1
no fix listed

Open the chart page →

7,313
geonetwork-k8sgeonetwork-k8sVerified publisher4.2.81 of 5See more

geonetwork-k8s geonetwork-k8s 4.2.8

1 of the 5 container images this version deploys carry CVE-2026-102990.

Container imageDigestPackageFixed in
library/kibana:7.17.150172f1c538e7
basic-ftp@5.0.3
6.2.1

Open the chart page →

37,657
h2ph2pVerified publisher1.0.11 of 1See more

h2p h2p 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-102990.

Container imageDigestPackageFixed in
dacinfomotion/h2p:latest68fa393b472c
basic-ftp@5.0.3
6.2.1

Open the chart page →

2,186
web-checkhajowielandVerified publisher1.0.11 of 1See more

web-check hajowieland 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-102990.

Container imageDigestPackageFixed in
ghcr.io/lissy93/web-check:latest7e2ef5261764
basic-ftp@5.3.1
6.2.1

Open the chart page →

8,454
dawarichhelmforgeVerified publisher1.0.21 of 4See more

dawarich helmforge 1.0.2

1 of the 4 container images this version deploys carry CVE-2026-102990.

Container imageDigestPackageFixed in
freikin/dawarich:1.15.2e58334ca5697
node-proxy-agents@7.1.1~0~2024040606-6+deb13u1
no fix listed

Open the chart page →

12,097
nocodbinseefrlab0.2.01 of 1See more

nocodb inseefrlab 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-102990.

Container imageDigestPackageFixed in
nocodb/nocodb:latest4ccfc5114506
basic-ftp@5.3.1
6.2.1

Open the chart page →

873
shinsei-managerjtektVerified publisher0.2.01 of 8See more

shinsei-manager jtekt 0.2.0

1 of the 8 container images this version deploys carry CVE-2026-102990.

Container imageDigestPackageFixed in
public.ecr.aws/jtekt-corporation/shinsei-manager:v2.8.15cd62142d6ed
basic-ftp@5.0.4
6.2.1

Open the chart page →

68,829
aperagkubeblocksVerified publisher0.0.0-nightly1 of 3See more

aperag kubeblocks 0.0.0-nightly

1 of the 3 container images this version deploys carry CVE-2026-102990.

Container imageDigestPackageFixed in
apecloud/aperag-frontend:v0.0.0-nightlyb3ae37840ace
basic-ftp@5.2.0
6.2.1

Open the chart page →

9,493
tianjimsgbyte0.1.171 of 2See more

tianji msgbyte 0.1.17

1 of the 2 container images this version deploys carry CVE-2026-102990.

Container imageDigestPackageFixed in
moonrailgun/tianji:1.11.2b528c8f8fcc4
basic-ftp@5.0.3
6.2.1

Open the chart page →

5,290
console-apiovrclk-20.1.11 of 1See more

console-api ovrclk-2 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-102990.

Container imageDigestPackageFixed in
ghcr.io/akash-network/console-api:2.64.0ba359097329d
basic-ftp@5.0.5
6.2.1

Open the chart page →

4,339
provider-proxyovrclk-20.1.11 of 1See more

provider-proxy ovrclk-2 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-102990.

Container imageDigestPackageFixed in
ghcr.io/akash-network/provider-proxy:1.4.353f533d7c6f8
basic-ftp@5.0.5
6.2.1

Open the chart page →

3,250
readability-js-serverreadability-js-server0.1.01 of 1See more

readability-js-server readability-js-server 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-102990.

Container imageDigestPackageFixed in
phpdockerio/readability-js-server:1.8.0ea8354b42600
basic-ftp@5.1.0
6.2.1

Open the chart page →

2,168
etherpadredhat-cop0.0.81 of 1See more

etherpad redhat-cop 0.0.8

1 of the 1 container images this version deploys carry CVE-2026-102990.

Container imageDigestPackageFixed in
etherpad/etherpad:latest98d395769b3b
basic-ftp@5.3.1
6.2.1

Open the chart page →

309

Container images carrying it

69 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
ghcr.io/adnoctem/lhci:1.0.119553e4b4033
basic-ftp@5.3.1
6.2.1
1
ghcr.io/akash-network/console-api:2.64.0ba359097329d
basic-ftp@5.0.5
6.2.1
1
ghcr.io/akash-network/provider-proxy:1.4.353f533d7c6f8
basic-ftp@5.0.5
6.2.1
1
ghcr.io/backstage/backstage:lateste2a48bb6ab55
basic-ftp@5.3.1
6.2.1
1
ghcr.io/browserless/chromium:v2.43.0853e6f105b51
basic-ftp@5.2.0
6.2.1
1
ghcr.io/cosmo-workspace/dev-code-server:v0.0.316fda01ae58a
basic-ftp@5.0.5
6.2.1
1
ghcr.io/flanksource/facet:0.1.73a0323f4283e5
basic-ftp@5.3.1
6.2.1
1
ghcr.io/formancehq/console-v3:v1.16.0c99e8ef2c545
basic-ftp@5.0.5
6.2.1
1
ghcr.io/formancehq/portal:v1.16.06efef5d19d56
basic-ftp@5.0.5
6.2.1
1
ghcr.io/manzil-infinity180/backend-dumpstore:226f28ca3efa6d3691044813cd09085e28d4a7b496c90cf82fdd
basic-ftp@5.0.5
6.2.1
1
ghcr.io/rybbit-io/rybbit-backend:lateste0d1b397e33c
basic-ftp@5.1.0
6.2.1
1
ghcr.io/wiremind/grafana-pdf-exporter:v1.7dbaa8527bf4c
basic-ftp@5.0.3
6.2.1
1
public.ecr.aws/g4a0y2u8/unifie-store:staging-19925a2057fabc948
basic-ftp@5.0.5
6.2.1
1
public.ecr.aws/jtekt-corporation/shinsei-manager:v2.8.15cd62142d6ed
basic-ftp@5.0.4
6.2.1
1
quay.io/rhdh/rhdh-hub-rhel9:latest4f8c0f8a8ee0
basic-ftp@5.3.0
6.2.1
1
quay.io/soketi/soketi:1.6-16-debian713223456cf1
basic-ftp@5.0.3
6.2.1
1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-backend:1.0.31c7afac3446d6
basic-ftp@5.2.0
6.2.1
1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-mq-consumer:1.0.310e3cd8c7776d
basic-ftp@5.0.5
6.2.1
1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-user:1.0.31d8a9cd4e1ae3
basic-ftp@5.2.0
6.2.1
1

syft 1.42.1 · advisories as of 6 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.