CVE-2026-100520: Laranode before 1.2.1 Path Traversal in File Manager Upload Endpoint
Laranode versions before 1.2.1 contain a path traversal vulnerability in the POST /filemanager/upload-file endpoint that allows authenticated users to write arbitrary files outside their home directory. Attackers can supply directory traversal sequences in the path parameter to write PHP files into other tenants' web roots and execute code as those tenants.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Laranodeto a version that resolves this vulnerability.Fixed in 1.2.1
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated to Laranode and able to send requests to the POST /filemanager/upload-file endpoint. The issue can affect other tenants because a malicious user can target files outside their own home directory.
What does successful exploitation allow?
An authenticated attacker can use directory traversal sequences in the path parameter to write arbitrary files outside their home directory. They can write PHP files into another tenant's web root and execute code as that tenant.
Which versions are affected?
Laranode versions before 1.2.1 are affected. Upgrading to 1.2.1 or later addresses the affected version range described here.
What should be investigated if compromise is suspected?
Review requests to POST /filemanager/upload-file for path parameters containing directory traversal sequences. Investigate unexpected PHP files, particularly those written into tenants' web roots or outside the uploading user's home directory.