CVE-2026-100520 | BDVDB-2026-379764 Detail
crivionLaranode
Description#
Laranode versions before 1.2.1 contain a path traversal vulnerability in the POST /filemanager/upload-file endpoint that allows authenticated users to write arbitrary files outside their home directory. Attackers can supply directory traversal sequences in the path parameter to write PHP files into other tenants' web roots and execute code as those tenants.
Impact#
Per CVSS v3.1: confidentiality impact high, integrity impact high, availability impact high. Attack vector: network.
Weaknesses#
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
References#
- https://github.com/crivion/laranode/security/advisories/GHSA-34h2-2696-vfvr
- https://github.com/crivion/laranode/pull/21
- https://github.com/crivion/laranode/commit/5c2b18ae99caf77a6fb6cc5c0ab66562bd673424
- https://github.com/crivion/laranode/releases/tag/v1.2.1
- https://github.com/crivion/laranode/blob/v1.2/app/Actions/Filemanager/UploadFileAction.php
- https://github.com/crivion/laranode
- https://www.vulncheck.com/advisories/laranode-before-1.2.1-path-traversal-in-file-manager-upload-endpoint
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.