Critical AdonisJS Bodyparser Flaw (CVSS 9.2) Enables Arbitrary File Write on Servers
Summary: A critical path traversal flaw in the @adonisjs/bodyparser npm package, tracked as CVE-2026-21440 with a CVSS score of 9.2, lets a remote attacker write arbitrary files on the server when MultipartFile.move() is called without the second options argument or without sanitizing the filename. The issue, reported by Hunter Wodzenski, requires a reachable upload endpoint, and AdonisJS notes that remote code execution is possible if an attacker overwrites application code, startup scripts, or configuration files that are later executed, though RCE is not guaranteed and depends on filesystem permissions, deployment layout, and runtime behavior.
Key Takeaway: A single upload endpoint calling MultipartFile.move() without a filename option hands an attacker a 9.2-severity write primitive that can overwrite startup scripts and configuration files - the difference between a defaced upload folder and code running on your server.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2025-68428CVE-2026-21440
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026