Description
Laranode versions before 1.2.1 contain a path traversal vulnerability in the POST /filemanager/upload-file endpoint that allows authenticated users to write arbitrary files outside their home directory. Attackers can supply directory traversal sequences in the path parameter to write PHP files into other tenants' web roots and execute code as those tenants.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| crivion | Laranode | < 1.2.1 | 1.2.1 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
GitHub 1 repository
-
wvllxe/CVE-2026-100520-laranode-path-traversal ★ 4 · Oct 2, 2026
Path Traversal -> RCE in Laranode < 1.2.1 (CWE-22). PoC + advisory writeup.
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- GitHub Security Advisory (GHSA-34h2-2696-vfvr) vendor-advisory
- https://github.com/crivion/laranode/pull/21 patch issue-tracking
- https://github.com/crivion/laranode/commit/5c2b18ae99caf77a6fb6cc5c0ab66562bd673424 patch
- Laranode v1.2.1 Release Notes release-notes
- https://github.com/crivion/laranode/blob/v1.2/app/Actions/Filemanager/UploadFileAction.php technical-description
- https://github.com/crivion/laranode product
- VulnCheck Advisory: Laranode before 1.2.1 Path Traversal in File Manager Upload Endpoint third-party-advisory