CVE-2026-21440 Details

A path traversal vulnerability has been identified in AdonisJS's multipart file handling, specifically in the @adonisjs/bodyparser package, through version 10.1.1 and 11.x prerelease versions prior to 11.0.0-next.6. This vulnerability allows remote attackers to write arbitrary files to locations on the server filesystem. The issue arises because the 'MultipartFile.move()' method, which handles file uploads, defaults to using the original client-provided filename. If this filename is not properly sanitized, an attacker can exploit the traversal sequences to write files outside the intended upload directory. Additionally, the default overwrite behavior can lead to unintentional file replacements.

Users can upgrade to @adonisjs/bodyparser versions 10.1.2 or 11.0.0-next.6, both of which include the necessary fix. Instructions for downloading these versions are available on the AdonisJS bodyparser GitHub releases page.