CVE-2026-21440: AdonisJS Path Traversal Vulnerability

CVE-2026-21440 Overview

A critical Path Traversal vulnerability has been identified in AdonisJS, a TypeScript-first web framework. The vulnerability exists in the multipart file handling component of the @adonisjs/bodyparser package, which may allow a remote attacker to write arbitrary files to arbitrary locations on the server filesystem. This type of vulnerability (CWE-22) can lead to severe consequences including remote code execution, data destruction, and complete system compromise.

Critical Impact

Remote attackers can exploit this path traversal vulnerability to write malicious files to any location on the server filesystem, potentially leading to remote code execution, configuration tampering, or deployment of web shells.

Affected Products

• @adonisjs/bodyparser through version 10.1.1
• @adonisjs/bodyparser 11.x prerelease versions prior to 11.0.0-next.6
• AdonisJS applications utilizing vulnerable bodyparser versions for multipart file uploads

Discovery Timeline

• January 2, 2026 - CVE-2026-21440 published to NVD
• January 8, 2026 - Last updated in NVD database

Technical Details for CVE-2026-21440

Vulnerability Analysis

This vulnerability stems from improper path validation in the AdonisJS bodyparser's multipart file handling functionality. When processing file uploads, the application fails to properly sanitize user-controlled filename parameters, allowing attackers to inject path traversal sequences (such as ../) into filenames. This enables writing uploaded files outside of the intended upload directory to arbitrary locations on the server filesystem.

The attack can be executed remotely over the network without requiring any authentication or user interaction. The successful exploitation of this vulnerability could result in complete compromise of the affected server, as attackers could overwrite critical system files, deploy web shells, or modify application configuration files.

Root Cause

The root cause of CVE-2026-21440 is inadequate input validation in the multipart file upload handler. The @adonisjs/bodyparser package does not properly sanitize or validate the filename provided in multipart form data requests before using it to determine the file's storage location. This allows path traversal sequences embedded in the filename to escape the designated upload directory.

Attack Vector

The vulnerability is exploitable via a network-based attack vector. An attacker can craft a malicious multipart HTTP request containing path traversal sequences in the filename field. When the vulnerable AdonisJS application processes this request, it will write the uploaded file to the attacker-specified location on the filesystem.

The attack scenario involves:

1. Attacker identifies an AdonisJS application with file upload functionality using a vulnerable version of @adonisjs/bodyparser
2. Attacker crafts a multipart form request with a malicious filename containing directory traversal sequences (e.g., ../../../etc/cron.d/malicious)
3. The bodyparser processes the request without proper path sanitization
4. The uploaded file is written to the attacker-controlled path on the server filesystem
5. Depending on the file location and content, this could result in code execution, configuration tampering, or other malicious outcomes

For detailed technical information about the exploitation mechanism, see the GitHub Security Advisory GHSA-gvq6-hvvp-h34h.

Detection Methods for CVE-2026-21440

Indicators of Compromise

• Unusual file creation events outside of designated upload directories
• Web server access logs showing multipart POST requests with suspicious filenames containing ../ sequences
• Presence of unexpected files in system directories, web roots, or configuration paths
• Modified cron jobs, systemd services, or other persistence mechanisms not created by administrators

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block path traversal sequences in multipart form data
• Monitor file system integrity using tools like AIDE, Tripwire, or SentinelOne to detect unauthorized file modifications
• Analyze HTTP request logs for filenames containing encoded or raw path traversal patterns (../, ..%2f, ..%5c)
• Deploy intrusion detection systems (IDS) with signatures for path traversal attack patterns

Monitoring Recommendations

• Enable detailed logging for file upload operations in AdonisJS applications
• Set up alerts for file creation events in sensitive directories such as /etc/, /var/www/, and application configuration paths
• Monitor for anomalous network traffic patterns targeting file upload endpoints
• Implement real-time file integrity monitoring on critical system and application directories

How to Mitigate CVE-2026-21440

Immediate Actions Required

• Update @adonisjs/bodyparser to version 10.1.2 or later for production environments
• Update @adonisjs/bodyparser to version 11.0.0-next.6 or later if using 11.x prerelease versions
• Audit file systems for evidence of exploitation and remove any suspicious files
• Review web server access logs for attempted exploitation attempts

Patch Information

The AdonisJS team has released security patches to address this vulnerability. The fixes are available in the following versions:

• Version 10.1.2 - Stable branch fix
• Version 11.0.0-next.6 - Prerelease branch fix

The patches implement proper path sanitization to prevent directory traversal attacks during file upload processing. Relevant commits include:

• Commit 143a16f3
• Commit 6795c0e3

Workarounds

• Implement a reverse proxy or WAF rule to strip or reject requests containing path traversal sequences in multipart filenames
• Add custom middleware to validate and sanitize uploaded filenames before they reach the bodyparser
• Configure file upload destinations with restrictive permissions to limit the impact of potential exploitation
• Use chroot or containerization to isolate the web application and limit filesystem access

# Example: Update @adonisjs/bodyparser to patched version
npm update @adonisjs/bodyparser@10.1.2

# Or for prerelease users
npm update @adonisjs/bodyparser@11.0.0-next.6

# Verify installed version
npm list @adonisjs/bodyparser