cve-2026-21440-writeup-poc

cve-2026-21440 @adonisjs/bodyparser의 경로 순회를 통한 임의 파일 쓰기 개요 @adonisjs/bodyparser 패키지에 의도된 업로드 디렉터리 외부에 임의의 파일을 작성할 수 있게 하는 치명적인 경로 순회 취약점이 존재합니다. multipartfile.move 함수가 명시적으로 정화된 파일명을 제공하지 않고 호출되면, 파서는 적절한 정화 없이 클라이언트가 제공한 파일명을 기본값으로 사용합니다. 구현이 path.join을 사용하고 options.overwrite가 기본적으로 true이기 때문에,...

CVE-2026-21440

CVE-2026-21440 PoC avanzato solo di rilevamento per CVE-2026-21440 che interessa AdonisJS BodyParser. Nessuno sfruttamento incluso. CVE-2026-21440 – PoC di rilevamento avanzato per AdonisJS Descrizione Questo progetto fornisce un Proof of Concept PoC avanzato solo di rilevamento per CVE-2026-2144...

CVE-2026-48795

Summary (CVE-2026-48795): AdonisJS’s bodyparser (/@adonisjs/bodyparser) has an incomplete fix for CVE-2026-25754 in certain pre-release ranges. The issue arises in nested multipart/form-data payloads (for example involving proto or constructor.prototype) that allow lodash _.set() through @poppins...

PT-2026-54440

Name of the Vulnerable Software and Affected Versions AdonisJS versions 10.1.3 through 10.1.4 AdonisJS versions 11.0.0-next.9 through 11.0.2 Description An incomplete fix in the @adonisjs/bodyparser module allows for prototype pollution via nested multipart field payloads. While direct payloads a...

Allocation of Resources Without Limits or Throttling

Overview @adonisjs/bodyparser is a BodyParser middleware for AdonisJS http server to read and parse request body Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the PartHandler class, during file type detection. An attacker can cause...

Prototype Pollution

Overview @adonisjs/bodyparser is a BodyParser middleware for AdonisJS http server to read and parse request body Affected versions of this package are vulnerable to Prototype Pollution when parsing form field data from non-JSON, non-URL-encoded multipart requests, in formfields.ts. due to...

GHSA-F5X2-VJ4H-VG4C AdonisJS multipart body parsing has Prototype Pollution issue

Description A Prototype Pollution vulnerability CWE-1321 in AdonisJS multipart form-data parsing may allow a remote attacker to manipulate object prototypes at runtime. This impacts @adonisjs/bodyparser through version 10.1.2 and 11.x prerelease versions prior to 11.0.0-next.8. This issue has bee...

PT-2026-6857

Description A Prototype Pollution vulnerability CWE-1321 in AdonisJS multipart form-data parsing may allow a remote attacker to manipulate object prototypes at runtime. This impacts @adonisjs/bodyparser through version 10.1.2 and 11.x prerelease versions prior to 11.0.0-next.8. This issue has bee...

Critical AdonisJS Bodyparser Flaw (CVSS 9.2) Enables Arbitrary File Write on Servers

Users of the "@adonisjs/bodyparser" npm package are being advised to update to the latest version following the disclosure of a critical security vulnerability that, if successfully exploited, could allow a remote attacker to write arbitrary files on the server. Tracked as CVE-2026-21440 CVSS...

Exploit for CVE-2026-21440

CVE-2026-21440 Advanced detection-only PoC for CVE-2026-21440...

CVE-2026-21440

AdonisJS is a TypeScript-first web framework. A Path Traversal vulnerability in AdonisJS multipart file handling may allow a remote attacker to write arbitrary files to arbitrary locations on the server filesystem. This impacts @adonisjs/bodyparser through version 10.1.1 and 11.x prerelease...