Critical AdonisJS Bodyparser Flaw (CVSS 9.2) Enables Arbitrary File Write on Servers

AdonisJS Bodyparser Path Traversal Vulnerability

The AdonisJS framework’s bodyparser package contains a critical path traversal vulnerability (CVE-2026-21440, CVSS 9.2) that allows attackers to write arbitrary files on the server. This flaw affects versions up to 10.1.1 and 11.0.0-next.5, and is resolved in versions 10.1.2 and 11.0.0-next.6 respectively.

The vulnerability stems from improper sanitization of filenames during file uploads, potentially enabling attackers to write files outside the intended upload directory. Successful exploitation could lead to remote code execution (RCE) depending on filesystem permissions and application configuration.

Why This Matters

Ideal web application security models assume client-provided data is untrusted and rigorously validated. In practice, developers often overlook sanitization steps, especially in file upload handling. This oversight can lead to severe consequences, like arbitrary file overwrites, potentially impacting the entire server infrastructure and leading to data breaches or system compromise; the cost of such incidents can easily reach millions of dollars.

Key Insights

• CVE-2026-21440 (CVSS 9.2): Path traversal vulnerability in @adonisjs/bodyparser reported January 6, 2026.
• MultipartFile.move(): The core function vulnerable to path traversal due to missing filename sanitization when the options parameter is omitted.
• jsPDF Vulnerability: A similar path traversal flaw was also disclosed in the jsPDF npm package (CVE-2025-68428, CVSS 9.2) impacting Node.js builds.

Working Example

// Vulnerable code snippet (example)
const multipart = new MultipartFile(request.files);
multipart.move('uploads'); // Missing filename sanitization!

// Secure code snippet
const multipart = new MultipartFile(request.files);
multipart.move('uploads', {
  name: 'sanitized_filename.txt', // Explicitly set a sanitized filename
  overwrite: false // Prevent overwriting existing files
});

Practical Applications

• E-commerce Platforms: A compromised e-commerce site using AdonisJS could allow attackers to overwrite critical application files, leading to data theft or service disruption.
• Pitfall: Relying on default parameters in file handling functions without explicit sanitization is a common anti-pattern that introduces significant security risks.

References:

• https://thehackernews.com/2026/01/critical-adonisjs-bodyparser-flaw-cvss.html