{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3aadonisjsadonisjs_bodyparser/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:adonisjs:adonisjs_bodyparser:*:*:*:*:*:*:*:*"],"_cs_cves":[{"id":"CVE-2026-21440"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["@adonisjs/bodyparser (\u003c= 10.1.1, 11.0.0-next.1 - 11.0.0-next.5)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Adonisjs"],"content_html":"\u003cp\u003eCVE-2026-21440 is a path traversal vulnerability in the \u003ccode\u003e@adonisjs/bodyparser\u003c/code\u003e package affecting versions up to 10.1.1 and 11.0.0-next.1 through 11.0.0-next.5. The vulnerability occurs when the \u003ccode\u003eMultipartFile.move()\u003c/code\u003e method is called without an explicit \u003ccode\u003ename\u003c/code\u003e parameter, allowing an attacker-provided \u003ccode\u003efilename\u003c/code\u003e in a \u003ccode\u003emultipart/form-data\u003c/code\u003e request to be concatenated into a destination path using \u003ccode\u003epath.join()\u003c/code\u003e. This enables attackers to escape the intended upload directory and overwrite arbitrary files on the server. The vulnerability has been confirmed fixed in \u003ccode\u003e@adonisjs/bodyparser@10.1.2\u003c/code\u003e and \u003ccode\u003e11.0.0-next.6\u003c/code\u003e.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an unauthenticated attacker to write or overwrite arbitrary files on the server filesystem. This can lead to remote code execution (RCE) if an attacker overwrites sensitive configuration files, web roots, or script files executed by the server.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade \u003ccode\u003e@adonisjs/bodyparser\u003c/code\u003e to version 10.1.2 or 11.0.0-next.6 immediately.\u003c/li\u003e\n\u003cli\u003eAudit web applications using \u003ccode\u003e@adonisjs/bodyparser\u003c/code\u003e to identify any routes calling \u003ccode\u003eMultipartFile.move()\u003c/code\u003e without an explicit, sanitized \u003ccode\u003ename\u003c/code\u003e option.\u003c/li\u003e\n\u003cli\u003eApply strict filename validation and sanitization for all user-provided file uploads.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-04T07:58:22Z","date_published":"2026-11-04T07:58:22Z","id":"https://feed.craftedsignal.io/briefs/2026-11-adonisjs-bodyparser-traversal/","summary":"An unauthenticated remote path traversal vulnerability in @adonisjs/bodyparser (CVE-2026-21440) allows attackers to write arbitrary files to the filesystem via malicious multipart/form-data filenames.","title":"AdonisJS Bodyparser: Arbitrary file write via path traversal (CVE-2026-21440)","url":"https://feed.craftedsignal.io/briefs/2026-11-adonisjs-bodyparser-traversal/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:adonisjs:adonisjs_bodyparser:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}