Critical Severity
CVE-2026-100520
Published: Oct 25, 2026
Path Traversal -> RCE in Laranode < 1.2.1 (CWE-22). PoC + advisory writeup.
# CVE-2026-100520 — Path Traversal → RCE in Laranode File Manager
> Authorized security research. PoC for defensive and educational use only.
Authenticated path traversal in the file-manager upload endpoint of [Laranode](https://github.com/crivion/laranode) lets a low-privileged tenant write arbitrary files **outside their own home directory** — including a PHP web shell into another tenant's web root — leading to remote code execution as that tenant.
| | |
|---|---|
| **CVE** | [CVE-2026-100520](https://www.cve.org/CVERecord?id=CVE-2026-100520) |
| **Product** | Laranode (multi-tenant hosting control panel, Laravel) |
| **Affected** | `>= 0`, `< 1.2.1` |
| **Fixed in** | [v1.2.1](https://github.com/crivion/laranode/releases/tag/v1.2.1) |
| **Vulnerability** | Path Traversal (CWE-22) → Arbitrary File Write → RCE |
| **Privileges** | Authenticated (any low-priv panel user) |
| **CVSS 3.1** | 8.8 HIGH — `AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H` |
| **CVSS 4.0** | 8.7 HIGH — `AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H` |
| **Discovered by** | Alisher Qarshibayev |
| **Advisory** | [VulnCheck](https://www.vulncheck.com/advisories/laranode-before-1.2.1-path-traversal-in-file-manager-upload-endpoint) · [GHSA-34h2-2696-vfvr](https://github.com/crivion/laranode/security/advisories/GHSA-34h2-2696-vfvr) |
## Root Cause
`app/Actions/Filemanager/UploadFileAction.php` builds the destination path by directly
concatenating the user-supplied `path` and `originalName` request fields onto the
tenant's home directory — with **no canonicalization and no traversal check**:
```php
// app/Actions/Filemanager/UploadFileAction.php (< 1.2.1)
$r->validate([
'file' => 'required|file',
'originalName' =>