cve-2026-21440-writeup-poc

cve-2026-21440 @adonisjs/bodyparser 中的路径遍历导致任意文件写入 概述 @adonisjs/bodyparser 包中存在一个严重的路径遍历漏洞，允许远程攻击者在预期上传目录之外写入任意文件。当调用 multipartfile.move 函数时，如果没有显式提供经过清理的文件名，解析器会默认使用客户端提供的文件名，且未进行适当的清理。 由于实现使用了 path.join 且 options.overwrite 默认为 true，攻击者可以构造包含目录遍历序列的恶意文件名（例如...

CVE-2026-21440

CVE-2026-21440 针对影响 AdonisJS BodyParser 的 CVE-2026-21440 的高级仅检测 PoC。不包含利用代码。 CVE-2026-21440 – AdonisJS 高级检测 PoC 描述 本项目为 CVE-2026-21440 提供了一个高级仅检测概念验证（PoC） ， 该漏洞是影响 AdonisJS 应用中 @adonisjs/bodyparser 的一个严重 路径遍历 / 任意文件写入 漏洞。 ⚠️ 本工具不会利用该漏洞。 它仅用于指纹识别、安全研究和防御性安全分析 。 关于 CVE-2026-21440 受影响框架 ：AdonisJS...

CVE-2026-48795

Summary (CVE-2026-48795): AdonisJS’s bodyparser (/@adonisjs/bodyparser) has an incomplete fix for CVE-2026-25754 in certain pre-release ranges. The issue arises in nested multipart/form-data payloads (for example involving proto or constructor.prototype) that allow lodash _.set() through @poppins...

PT-2026-54440

Name of the Vulnerable Software and Affected Versions AdonisJS versions 10.1.3 through 10.1.4 AdonisJS versions 11.0.0-next.9 through 11.0.2 Description An incomplete fix in the @adonisjs/bodyparser module allows for prototype pollution via nested multipart field payloads. While direct payloads a...

Allocation of Resources Without Limits or Throttling

Overview @adonisjs/bodyparser is a BodyParser middleware for AdonisJS http server to read and parse request body Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the PartHandler class, during file type detection. An attacker can cause...

Prototype Pollution

Overview @adonisjs/bodyparser is a BodyParser middleware for AdonisJS http server to read and parse request body Affected versions of this package are vulnerable to Prototype Pollution when parsing form field data from non-JSON, non-URL-encoded multipart requests, in formfields.ts. due to...

GHSA-F5X2-VJ4H-VG4C AdonisJS multipart body parsing has Prototype Pollution issue

Description A Prototype Pollution vulnerability CWE-1321 in AdonisJS multipart form-data parsing may allow a remote attacker to manipulate object prototypes at runtime. This impacts @adonisjs/bodyparser through version 10.1.2 and 11.x prerelease versions prior to 11.0.0-next.8. This issue has bee...

PT-2026-6857

Description A Prototype Pollution vulnerability CWE-1321 in AdonisJS multipart form-data parsing may allow a remote attacker to manipulate object prototypes at runtime. This impacts @adonisjs/bodyparser through version 10.1.2 and 11.x prerelease versions prior to 11.0.0-next.8. This issue has bee...

Critical AdonisJS Bodyparser Flaw (CVSS 9.2) Enables Arbitrary File Write on Servers

Users of the "@adonisjs/bodyparser" npm package are being advised to update to the latest version following the disclosure of a critical security vulnerability that, if successfully exploited, could allow a remote attacker to write arbitrary files on the server. Tracked as CVE-2026-21440 CVSS...

Exploit for CVE-2026-21440

CVE-2026-21440 Advanced detection-only PoC for CVE-2026-21440...

CVE-2026-21440

AdonisJS is a TypeScript-first web framework. A Path Traversal vulnerability in AdonisJS multipart file handling may allow a remote attacker to write arbitrary files to arbitrary locations on the server filesystem. This impacts @adonisjs/bodyparser through version 10.1.1 and 11.x prerelease...