CVE-2026-21440

🗓️ 02 Jan 2026 19:02:18Reported by GitHub_MType

cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 14 Views🌐 WEB

Path traversal in AdonisJS file handling allows arbitrary file writes; patched in bodyparser 10.1.2 and 11.0.0-next.6.

Reporter	Title	Published	Views	Family All 18
GithubExploit	Exploit for CVE-2026-21440	30 Jan 202607:19	–	githubexploit
GithubExploit	Exploit for CVE-2026-21440	5 Jan 202622:40	–	githubexploit
GithubExploit	Exploit for CVE-2026-21440	8 Jan 202600:55	–	githubexploit
Circl	CVE-2026-21440	2 Jan 202615:55	–	circl
CNNVD	bodyparser 路径遍历漏洞	2 Jan 202600:00	–	cnnvd
Cvelist	CVE-2026-21440 AdonisJS Path Traversal in Multipart File Handling	2 Jan 202619:02	–	cvelist
EUVD	EUVD-2026-0036	2 Jan 202619:02	–	euvd
Github Security Blog	AdonisJS Path Traversal in Multipart File Handling	2 Jan 202618:58	–	github
NVD	CVE-2026-21440	2 Jan 202619:15	–	nvd
OSV	CVE-2026-21440 AdonisJS Path Traversal in Multipart File Handling	2 Jan 202619:02	–	osv

Vulners

Node

adonisjs coreRange<10.1.2

adonisjs coreRange11.0.0-next.0–11.0.0-next.6

[
  {
    "vendor": "adonisjs",
    "product": "core",
    "versions": [
      {
        "version": "< 10.1.2",
        "status": "affected"
      },
      {
        "version": ">= 11.0.0-next.0, < 11.0.0-next.6",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/adonisjs/core/security/advisories/GHSA-gvq6-hvvp-h34h
github	www.github.com/adonisjs/bodyparser/commit/143a16f35602be8561215611582211dec280cae6
github	www.github.com/adonisjs/bodyparser/commit/6795c0e3fa824ae275bbd992aae60609e96f0f03
github	www.github.com/adonisjs/bodyparser/releases/tag/v10.1.2
github	www.github.com/adonisjs/bodyparser/releases/tag/v11.0.0-next.6

Parameter	Position	Path	Description	CWE
file	request body	/upload	Path traversal via unsanitized client-controlled filename in file uploads leading to arbitrary file write	CWE-22

15 Apr 2026 00:35Current

6.7Medium risk

Vulners AI Score6.7

CVSS 49.2

EPSS0.00097

SSVC

CWE-22