Vulnerability · Published Sep 26, 2026 · Assigned by VulnCheck

CVE-2026-100520Laranode before 1.2.1 Path Traversal in File Manager Upload Endpoint

High 8.8

In plain English

A high-severity path traversal in Laranode from crivion. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 66% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)1.1%top 33.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling1Public PoC

Official description

Laranode versions before 1.2.1 contain a path traversal vulnerability in the POST /filemanager/upload-file endpoint that allows authenticated users to write arbitrary files outside their home directory. Attackers can supply directory traversal sequences in the path parameter to write PHP files into other tenants' web roots and execute code as those tenants.

Affected products (as reported)

Vendor	Product	Versions
crivion	Laranode	0 – before 1.2.1

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

GitHub Security Advisory (GHSA-34h2-2696-vfvr) vendor-advisory
https://github.com/crivion/laranode/pull/21 patch, issue-tracking
https://github.com/crivion/laranode/commit/5c2b18ae99caf77a6fb6cc5c0ab66562bd673424 patch
Laranode v1.2.1 Release Notes release-notes
https://github.com/crivion/laranode/blob/v1.2/app/Actions/Filemanager/UploadFileAction.php technical-description
https://github.com/crivion/laranode product
VulnCheck Advisory: Laranode before 1.2.1 Path Traversal in File Manager Upload Endpoint third-party-advisory