AdonisJS Bodyparser: Arbitrary file write via path traversal (CVE-2026-21440)

CVE-2026-21440 is a path traversal vulnerability in the @adonisjs/bodyparser package affecting versions up to 10.1.1 and 11.0.0-next.1 through 11.0.0-next.5. The vulnerability occurs when the MultipartFile.move() method is called without an explicit name parameter, allowing an attacker-provided filename in a multipart/form-data request to be concatenated into a destination path using path.join(). This enables attackers to escape the intended upload directory and overwrite arbitrary files on the server. The vulnerability has been confirmed fixed in @adonisjs/bodyparser@10.1.2 and 11.0.0-next.6.

Impact

Successful exploitation allows an unauthenticated attacker to write or overwrite arbitrary files on the server filesystem. This can lead to remote code execution (RCE) if an attacker overwrites sensitive configuration files, web roots, or script files executed by the server.

Recommendation

• Upgrade @adonisjs/bodyparser to version 10.1.2 or 11.0.0-next.6 immediately.
• Audit web applications using @adonisjs/bodyparser to identify any routes calling MultipartFile.move() without an explicit, sanitized name option.
• Apply strict filename validation and sanitization for all user-provided file uploads.