https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 19:35:22 +0000 https://cve.radiocsirt.org/vuln/bdu:2026-00120 bdu:2026-00120 https://cve.radiocsirt.org/vuln/bdu:2026-00120 https://cve.radiocsirt.org/vuln/euvd-2026-264890 EUVD-2026-264890 https://cve.radiocsirt.org/vuln/euvd-2026-264890 https://cve.radiocsirt.org/vuln/fkie_cve-2026-21440 <p>AdonisJS is a TypeScript-first web framework. A Path Traversal vulnerability in AdonisJS multipart file handling may allow a remote attacker to write arbitrary files to arbitrary locations on the server filesystem. This impacts @adonisjs/bodyparser through version 10.1.1 and 11.x prerelease versions prior to 11.0.0-next.6. This issue has been patched in @adonisjs/bodyparser versions 10.1.2 and 11.0.0-next.6.</p> <p>AdonisJS is a TypeScript-first web framework. A Path Traversal vulnerability in AdonisJS multipart file handling may allow a remote attacker to write arbitrary files to arbitrary locations on the server filesystem. This impacts @adonisjs/bodyparser through version 10.1.1 and 11.x prerelease versions prior to 11.0.0-next.6. This issue has been patched in @adonisjs/bodyparser versions 10.1.2 and 11.0.0-next.6.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-21440 https://cve.radiocsirt.org/vuln/ghsa-gvq6-hvvp-h34h <p><strong>Affected:</strong> npm: @adonisjs/bodyparser</p> <p>### Summary</p> <p>**Description** A Path Traversal (CWE-22) vulnerability in AdonisJS multipart file handling may allow a remote attacker to write arbitrary files to arbitrary locations on the server filesystem. This impacts @adonisjs/bodyparser through version 10.1.1 and 11.x prerelease versions prior to 11.0.0-next.6. This issue has been patched in @adonisjs/bodyparser versions 10.1.2 and 11.0.0-next.6.</p> <p>### Details AdonisJS parses `multipart/form-data` via `BodyParser` and exposes uploads as `MultipartFile`. The issue is in the `MultipartFile.move(location, options)` default options. If `options.name` isn&#39;t provided, it defaults to the unsanitized client filename and builds the destination with `path.join(location, name)`, allowing a traversal to escape the default or intended directory chosen by the developer. If `options.overwrite` isn&#39;t provided, it defaults to true, allowing file overwrites. The documentation previously demonstrated examples leading developers to this vulnerable code path. ### Impact</p> <p>Exploitation requires a reachable upload endpoint. If a developer uses `MultipartFile.move()` without the second `options` argument or without explicitly sanitizing the filename, an attacker can supply a crafted `filename` value containing traversal sequences, writing to a destination path outside the intended upload directory. This can lead to arbitrary file write on the server.</p> <p>If the attacker can overwrite application code, startup scripts, or configuration files that are…</p> <p><strong>Affected:</strong> npm: @adonisjs/bodyparser</p> <p>### Summary</p> <p>**Description** A Path Traversal (CWE-22) vulnerability in AdonisJS multipart file handling may allow a remote attacker to write arbitrary files to arbitrary locations on the server filesystem. This impacts @adonisjs/bodyparser through version 10.1.1 and 11.x prerelease versions prior to 11.0.0-next.6. This issue has been patched in @adonisjs/bodyparser versions 10.1.2 and 11.0.0-next.6.</p> <p>### Details AdonisJS parses `multipart/form-data` via `BodyParser` and exposes uploads as `MultipartFile`. The issue is in the `MultipartFile.move(location, options)` default options. If `options.name` isn&#39;t provided, it defaults to the unsanitized client filename and builds the destination with `path.join(location, name)`, allowing a traversal to escape the default or intended directory chosen by the developer. If `options.overwrite` isn&#39;t provided, it defaults to true, allowing file overwrites. The documentation previously demonstrated examples leading developers to this vulnerable code path. ### Impact</p> <p>Exploitation requires a reachable upload endpoint. If a developer uses `MultipartFile.move()` without the second `options` argument or without explicitly sanitizing the filename, an attacker can supply a crafted `filename` value containing traversal sequences, writing to a destination path outside the intended upload directory. This can lead to arbitrary file write on the server.</p> <p>If the attacker can overwrite application code, startup scripts, or configuration files that are…</p> https://cve.radiocsirt.org/vuln/ghsa-gvq6-hvvp-h34h