CVE-2026-100520CWE-22path-traversal

CVE-2026-100520

High · published September 26, 2026

CVSS v3.1
8.8
EPSS
1%
Percentile
60.5
In the wild
Unconfirmed
What it is

Laranode versions before 1.2.1 contain a path traversal vulnerability in the POST /filemanager/upload-file endpoint that allows authenticated users to write arbitrary files outside their home directory. Attackers can supply directory traversal sequences in the path parameter to write PHP files into other tenants' web roots and execute code as those tenants.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
8.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00937 · 60.5th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-09-26T05:17Z
References (7)
https://github.com/crivion/laranode · [email protected]https://github.com/crivion/laranode/blob/v1.2/app/Actions/Filemanager/UploadFileAction.php · [email protected]https://github.com/crivion/laranode/commit/5c2b18ae99caf77a6fb6cc5c0ab66562bd673424 · [email protected]https://github.com/crivion/laranode/pull/21 · [email protected]https://github.com/crivion/laranode/releases/tag/v1.2.1 · [email protected]https://github.com/crivion/laranode/security/advisories/GHSA-34h2-2696-vfvr · [email protected]https://www.vulncheck.com/advisories/laranode-before-1.2.1-path-traversal-in-file-manager-upload-endpoint · [email protected]
EPSS history
Timeline
  • 27 SEP 03:24Z
    EPSS moved — → 1%
    epss
  • 26 SEP 00:59Z
    Laranode before 1.2.1 Path Traversal in File Manager Upload Endpoint
    cvelistv5