CVE-2026-100520

EUVD-2026-87375
Laranode versions before 1.2.1 contain a path traversal vulnerability in the POST /filemanager/upload-file endpoint that allows authenticated users to write arbitrary files outside their home directory. Attackers can supply directory traversal sequences in the path parameter to write PHP files into other tenants' web roots and execute code as those tenants.
Path Traversal
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
8.8 HIGH
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 59.29%
Common Weakness Enumeration
References
https://github.com/crivion/laranode
https://github.com/crivion/laranode/blob/v1.2/app/Actions/Filemanager/UploadFileAction.php
https://github.com/crivion/laranode/commit/5c2b18ae99caf77a6fb6cc5c0ab66562bd673424
https://github.com/crivion/laranode/pull/21
https://github.com/crivion/laranode/releases/tag/v1.2.1
https://github.com/crivion/laranode/security/advisories/GHSA-34h2-2696-vfvr
https://www.vulncheck.com/advisories/laranode-before-1.2.1-path-traversal-in-file-manager-upload-endpoint