CVE-2026-100520
Laranode versions before 1.2.1 contain a path traversal vulnerability in the POST…
- Risk score
- 65/100
- CVSS
- 8.8 v3.1
- Exploit chance (30 days)
- 0.9%
- Published
- 26 Sep 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Laranode versions before 1.2.1 contain a path traversal vulnerability in the POST /filemanager/upload-file endpoint that allows authenticated users to write arbitrary files outside their home directory. Attackers can supply directory traversal sequences in the path parameter to write PHP files into other tenants' web …
- Affected
- See advisory
- Fix
- Upgrade the product to 1.2.1 or later.
- Exploitation
- No known exploitation
Why it is Amber
- CVSS 8.8 high
References
- https://github.com/crivion/laranode
- https://github.com/crivion/laranode/blob/v1.2/app/Actions/Filemanager/UploadFileAction.php
- https://github.com/crivion/laranode/commit/5c2b18ae99caf77a6fb6cc5c0ab66562bd673424
- https://github.com/crivion/laranode/pull/21
- https://github.com/crivion/laranode/releases/tag/v1.2.1
- https://github.com/crivion/laranode/security/advisories/GHSA-34h2-2696-vfvr
- https://www.vulncheck.com/advisories/laranode-before-1.2.1-path-traversal-in-file-manager-upload-endpoint
Original description
Laranode versions before 1.2.1 contain a path traversal vulnerability in the POST /filemanager/upload-file endpoint that allows authenticated users to write arbitrary files outside their home directory. Attackers can supply directory traversal sequences in the path parameter to write PHP files into other tenants' web roots and execute code as those tenants.
Last activity 26 Sep 2026. Patch Forecast updates every hour.