CVE-2026-100520 Laranode before 1.2.1 Path Traversal in File Manager Upload Endpoint
Authenticated attackers can exploit path traversal in the file upload endpoint to write arbitrary files and execute code as other tenants.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-100520?
CVE-2026-100520 is a high-severity path traversal vulnerability in crivion Laranode, published on 26 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Laranode versions before 1.2.1 contain a path traversal vulnerability in the POST /filemanager/upload-file endpoint that allows authenticated users to write arbitrary files outside their home directory. Attackers can supply directory traversal sequences in the path parameter to write PHP files into other tenants' web roots and execute code as those tenants.
Weakness: CWE-22
Which versions are affected by CVE-2026-100520?
How do I fix CVE-2026-100520?
No fix has been published for CVE-2026-100520 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-100520 being exploited?
There is no known exploitation of CVE-2026-100520 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as GHSA-34h2-2696-vfvr, GHSA-7q7h-5g76-8cq4.