---
id: CVE-2026-100520
title: >-
  Laranode versions before 1.2.1 contain a path traversal vulnerability in the
  POST /filemanager/upload-file endpoint that allows authenticated users to
  write arbitrary files outside their home directory
summary: >-
  Laranode versions before 1.2.1 contain a path traversal vulnerability in the
  POST /filemanager/upload-file endpoint that allows authenticated users to
  write arbitrary files outside their home directory. Attackers can supply
  directory tra…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-22
vendor: crivion
product: Laranode
affected:
  - Laranode < 1.2.1
published: '2026-09-26'
updated: '2026-09-26'
sourceUpdated: '2026-09-26T01:17:00.357'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-100520'
references:
  - url: 'https://github.com/crivion/laranode'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/crivion/laranode/blob/v1.2/app/Actions/Filemanager/UploadFileAction.php
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/crivion/laranode/commit/5c2b18ae99caf77a6fb6cc5c0ab66562bd673424
    label: disclosure@vulncheck.com
  - url: 'https://github.com/crivion/laranode/pull/21'
    label: disclosure@vulncheck.com
  - url: 'https://github.com/crivion/laranode/releases/tag/v1.2.1'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/crivion/laranode/security/advisories/GHSA-34h2-2696-vfvr
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/laranode-before-1.2.1-path-traversal-in-file-manager-upload-endpoint
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
ingestedAt: '2026-09-26T01:24:36.886Z'
---

## Overview

Laranode versions before 1.2.1 contain a path traversal vulnerability in the POST /filemanager/upload-file endpoint that allows authenticated users to write arbitrary files outside their home directory. Attackers can supply directory traversal sequences in the path parameter to write PHP files into other tenants' web roots and execute code as those tenants.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.