एडोनिसजेएस में मल्टीपार्ट फ़ाइल हैंडलिंग में पाथ ट्रैवर्सल

The core of the vulnerability lies in the MultipartFile.move(location, options) function within @adonisjs/bodyparser. The default options for this function are insufficiently restrictive, allowing an attacker to manipulate the location parameter to write files outside of the intended upload directory. This can be exploited by crafting malicious multipart/form-data requests that include a carefully crafted filename. Successful exploitation could allow an attacker to overwrite critical system files, execute arbitrary code, or gain persistent access to the server. The blast radius extends to any application utilizing @adonisjs/bodyparser for file uploads, potentially impacting sensitive data and system integrity.

Applications built with the AdonisJS framework that utilize @adonisjs/bodyparser for file uploads are at risk. This includes web applications, APIs, and any other services that process multipart/form-data requests. Specifically, applications using older versions of AdonisJS or those with custom file upload handling logic that doesn't adequately validate the upload location are particularly vulnerable.

• nodejs / server:

  npm list @adonisjs/bodyparser

• nodejs / server:

  npm audit @adonisjs/bodyparser

• nodejs / server:

  grep -r 'MultipartFile.move' /path/to/your/app/http/controllers

• generic web: Inspect application logs for unusual file creation events or errors related to file uploads, particularly those involving path traversal attempts.

1. 2026-01-02Disclosure

   disclosure

2. 2026-01-02Patch

   patch

1. आरक्षित2025-12-29
2. प्रकाशित2026-01-02
3. संशोधित2026-02-03
4. EPSS अद्यतन2026-03-23

The primary mitigation for CVE-2026-21440 is to immediately upgrade to @adonisjs/bodyparser version 10.1.2 or 11.0.0-next.6 or later. If upgrading is not immediately feasible, consider implementing a Web Application Firewall (WAF) rule to filter requests containing suspicious filenames or path traversal sequences in the location parameter. Additionally, restrict file upload permissions to the minimum necessary and implement strict input validation to prevent malicious filenames from being processed. Review and harden the application's file handling logic to ensure that uploaded files are stored in a secure location and are properly sanitized before use. After upgrading, confirm the fix by attempting to upload a file with a path traversal payload (e.g., ../../../../etc/passwd) and verifying that the upload fails with an appropriate error.