CVE-2026-100520

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-100520
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-100520.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-100520
Aliases
  • GHSA-34h2-2696-vfvr
Published
2026-09-26T00:59:22Z
Modified
2026-09-27T03:47:18Z
Severity
  • 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
Laranode before 1.2.1 Path Traversal in File Manager Upload Endpoint
Details

Laranode versions before 1.2.1 contain a path traversal vulnerability in the POST /filemanager/upload-file endpoint that allows authenticated users to write arbitrary files outside their home directory. Attackers can supply directory traversal sequences in the path parameter to write PHP files into other tenants' web roots and execute code as those tenants.

Database specific 
{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-22"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/100xxx/CVE-2026-100520.json"
}
References

Affected packages

Git / github.com/crivion/laranode

Affected ranges

Type
GIT
Repo
https://github.com/crivion/laranode
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
1300a8c17163e35ff3447e95a1978dbc5ed5c6aa
Fixed
5c2b18ae99caf77a6fb6cc5c0ab66562bd673424
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "1.2.1"
        }
    ],
    "source":  [
        "DESCRIPTION",
        "REFERENCES"
    ]
}

Affected versions

v1.*
v1.1
v1.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-100520.json"