CVE-2026-21440: 
JavaScript vulnerability analysis and mitigation

CVE-2026-21440 is a path traversal vulnerability (CWE-22) in the AdonisJS @adonisjs/bodyparser package affecting multipart file upload handling. When developers call MultipartFile.move() without explicitly providing a sanitized filename in the options argument, the function defaults to using the unsanitized client-supplied filename, allowing an attacker to supply traversal sequences (e.g., ../) to write files outside the intended upload directory. Affected versions are @adonisjs/bodyparser ≤ 10.1.1 and 11.x prerelease versions ≤ 11.0.0-next.5. The vulnerability was disclosed on January 2, 2026, and carries a CVSS v4.0 base score of 9.2 (Critical) (GitHub Advisory).

The root cause (CWE-22) lies in MultipartFile.move(location, options) within src/multipart/file.ts. When options.name is not provided, the code previously defaulted to this.clientName — the raw, unsanitized filename submitted by the client — and constructed the destination path using path.join(location, name). Because path.join does not strip traversal sequences, a filename like ../../app/routes.ts resolves outside the intended upload directory. Additionally, options.overwrite defaulted to true, enabling silent overwrite of existing files. The fix (commits 6795c0e and 143a16f) replaces the default filename with a cryptographically random UUID plus the file extension, eliminating reliance on client input (GitHub Advisory, Patch Commit v10, Patch Commit v11). Exploitation requires a reachable file upload endpoint where the developer has not explicitly sanitized the filename.

Successful exploitation allows an unauthenticated remote attacker to write arbitrary files to any location on the server filesystem that the Node.js process has write access to. If the attacker can overwrite application source files, startup scripts, configuration files, or template files that are subsequently executed or loaded by the runtime, remote code execution (RCE) becomes possible. RCE is not guaranteed and depends on filesystem permissions, deployment layout, and application behavior, but the potential for full server compromise — including data exfiltration, service disruption, and lateral movement — is significant (GitHub Advisory, Feedly).

A public proof-of-concept exploit was published on GitHub (https://github.com/Ashwesker/Ashwesker-CVE-2026-21440) on January 5, 2026, and a second PoC/writeup appeared at https://github.com/you-ssef9/CVE-2026-21440 and https://github.com/k0nnect/cve-2026-21440-writeup shortly after. A Nuclei detection template was also submitted to ProjectDiscovery's template repository. As of the time of reporting, there is no confirmed evidence of in-the-wild exploitation, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.317%, indicating a relatively low (but non-negligible) probability of exploitation in the near term. No specific threat actor attribution has been made (Feedly, PoC GitHub).

1. Reconnaissance: Identify AdonisJS applications with publicly accessible file upload endpoints. Use tools like Shodan, Censys, or FOFA to find internet-facing AdonisJS instances, or inspect application routes for multipart/form-data handling.
2. Confirm vulnerable version: Check the application's package.json or npm lock file (if accessible) to confirm @adonisjs/bodyparser ≤ 10.1.1 or ≤ 11.0.0-next.5 is in use.
3. Craft malicious multipart request: Construct a multipart/form-data HTTP POST request to the upload endpoint. Set the filename field in the Content-Disposition header of the file part to a path traversal payload, e.g., ../../../../app/routes.ts or ../../../../.env.
4. Submit the request: Send the crafted request using a tool such as curl, Burp Suite, or a custom script:

   curl -X POST https://target.example.com/upload \
     -F "file=@malicious.js;filename=../../server.js"

5. Achieve arbitrary file write: If the application calls file.move(uploadDir) without an explicit options.name, the server writes the uploaded content to the traversed path (e.g., overwriting server.js in the application root).
6. Trigger RCE (if applicable): If the overwritten file is loaded or executed by the Node.js runtime (e.g., a route file, startup script, or configuration file), restart or reload the application to trigger execution of the attacker-controlled code, achieving RCE (GitHub Advisory, PoC GitHub).

• Network: Multipart POST requests to file upload endpoints where the Content-Disposition filename field contains ../, ..\, URL-encoded traversal sequences (%2e%2e%2f), or absolute path prefixes; unexpected outbound connections from the Node.js process after a file upload event.
• File System: Presence of unexpected files outside the designated upload directory (e.g., modified .js, .ts, .json, or .env files in the application root or parent directories); newly created or recently modified application source files with timestamps coinciding with upload activity; files with random UUID-like names in unexpected directories (may indicate probing).
• Logs: Web server or AdonisJS access logs showing POST requests to upload endpoints with unusually long or path-containing filenames in the request body; Node.js error logs referencing unexpected file paths during move operations.
• Process: Unusual child processes spawned by the Node.js/AdonisJS process (e.g., sh, bash, curl, wget, python) following a file upload event; unexpected network listeners or connections initiated by the application process (GitHub Advisory, Feedly).

Primary remediation: Upgrade @adonisjs/bodyparser to version 10.1.2 (stable) or 11.0.0-next.6 (prerelease) or later. These releases change the default filename behavior in MultipartFile.move() to use a cryptographically random UUID instead of the client-supplied name, eliminating the traversal vector (v10.1.2 Release, v11.0.0-next.6 Release).

Workarounds (if immediate patching is not possible):

• Always pass an explicit, sanitized options.name when calling file.move(location, { name: sanitizedName }).
• Strip or reject any ../, ..\, or absolute path components from user-supplied filenames before use.
• Apply the principle of least privilege to the Node.js process's filesystem permissions to limit the blast radius of arbitrary writes.
• Disable file upload functionality entirely if not required by the application.

The vulnerability received broad coverage from security media outlets including The Hacker News, GBHackers, CyberSecurityNews, and SecurityOnline, all highlighting the critical CVSS 9.2 score and potential for RCE (The Hacker News, GBHackers). Community discussion appeared on Reddit (r/SecOpsDaily, r/pwnhub) and Mastodon/Bluesky infosec accounts, with researchers noting the vulnerability stems from insecure defaults in the framework's documentation examples. SmarterMSP published a threat advisory, and the AdonisJS maintainer (RomainLanz) published the advisory and patches promptly on the same day as disclosure. The fix was noted as a breaking change by the maintainers, who nonetheless shipped it as a patch release to maximize reach (GitHub Advisory, v10.1.2 Release).