Critical AdonisJS Vulnerability Allows Remote Attackers to Write Files on Server
A critical path traversal vulnerability has been identified in AdonisJS's multipart file handling, which may enable remote attackers to write arbitrary files to server locations outside the designated upload directory.
A critical path traversal vulnerability has been identified in AdonisJS's multipart file handling, which may enable remote attackers to write arbitrary files to server locations outside the designated upload directory.
This vulnerability, designated as CVE-2026-21440, affects @adonisjs/bodyparser versions through 10.1.1 and all 11.x prerelease versions before 11.0.0-next.6. Patches are now available in versions 10.1.2 and 11.0.0-next.6.
The issue arises from the handling of the MultipartFile.move(location, options) function within multipart/form-data processing by the BodyParser middleware. If the options parameter is omitted or lacks a sanitized filename, the system defaults to using the unsanitized client-supplied filename.
The vulnerable code constructs the destination path using path.join(location, name) , which does not adequately validate traversal sequences embedded in the filename parameter.
Furthermore, if developers do not explicitly set the options overwrite parameter, it defaults to true , allowing file overwrites at the calculated destination.
This creates a potential for attackers to supply crafted filenames containing directory traversal sequences (e.g., "../../../") to escape the intended upload directory and write files to unauthorized locations on the filesystem.
If the options parameter is omitted or lacks a sanitized filename, the system defaults to using the unsanitized client-supplied filename.
AdonisJS documentation previously included code examples that inadvertently exposed developers to this vulnerability, increasing the attack surface.
Exploitation requires a reachable upload endpoint within the application. Developers who use MultipartFile.move() without properly sanitizing the filename parameter or providing the options argument risk exposing their application to this vulnerability.
If an attacker can write files outside the intended directory, various attack chains, including remote code execution (RCE), may become feasible. RCE depends on factors like filesystem permissions, deployment architecture, and application runtime behavior.
In environments with proper permission segmentation, the vulnerability may be limited to file write capabilities without enabling code execution.
This vulnerability is assigned a critical CVSS v4.0 base score with the vector string CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N.
The metrics indicate a network-based attack vector with low complexity and no authentication requirements, although specific conditions must be present for successful exploitation. High impacts on confidentiality, integrity, and availability make this a critical security issue for organizations using vulnerable AdonisJS versions.
Organizations are advised to upgrade to @adonisjs/bodyparser version 10.1.2 or later for stable releases, or version 11.0.0-next.6 for those on the prerelease track.
Development teams should audit existing upload handlers to ensure proper filename sanitization and explicit options configuration. The AdonisJS security team recommends implementing strict input validation on all client-supplied filenames and explicitly setting the overwrite parameter to false unless overwriting is expressly required and validated.
Based on reporting by GBHackers.