CVE-2026-100520

Name of the Vulnerable Software and Affected Versions Laranode versions prior to 1.2.1

Description Authenticated users can exploit a path traversal flaw to write arbitrary files outside their designated home directory. By providing directory traversal sequences in the path parameter of the 'POST /filemanager/upload-file' endpoint, an attacker can place PHP files into the web roots of other tenants, potentially leading to remote code execution as those tenants. This issue occurs because the software uses attacker-controlled path values to determine upload destinations without sufficient traversal protections.

Recommendations Update to version 1.2.1. Restrict access to the 'POST /filemanager/upload-file' endpoint or avoid using the path parameter until the update is applied.