Vulnerability Description
Laranode versions before 1.2.1 contain a path traversal vulnerability in the POST /filemanager/upload-file endpoint that allows authenticated users to write arbitrary files outside their home directory. Attackers can supply directory traversal sequences in the path parameter to write PHP files into other tenants' web roots and execute code as those tenants.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/crivion/laranode
- https://github.com/crivion/laranode/blob/v1.2/app/Actions/Filemanager/UploadFile
- https://github.com/crivion/laranode/commit/5c2b18ae99caf77a6fb6cc5c0ab66562bd673
- https://github.com/crivion/laranode/pull/21
- https://github.com/crivion/laranode/releases/tag/v1.2.1
- https://github.com/crivion/laranode/security/advisories/GHSA-34h2-2696-vfvr
- https://www.vulncheck.com/advisories/laranode-before-1.2.1-path-traversal-in-fil
FAQ
What is CVE-2026-100520?
CVE-2026-100520 is a vulnerability with a CVSS score of 8.8 (HIGH). Laranode versions before 1.2.1 contain a path traversal vulnerability in the POST /filemanager/upload-file endpoint that allows authenticated users to write arbitrary files outside their home director...
How severe is CVE-2026-100520?
CVE-2026-100520 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-100520?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.