CVE-2026-21440

AdonisJS is a TypeScript-first web framework. A Path Traversal vulnerability in AdonisJS multipart file handling may allow a remote attacker to write arbitrary files to arbitrary locations on the server filesystem. This impacts @adonisjs/bodyparser through version 10.1.1 and 11.x prerelease versions prior to 11.0.0-next.6. This issue has been patched in @adonisjs/bodyparser versions 10.1.2 and 11.0.0-next.6.

• CWE-22

• https://github.com/adonisjs/bodyparser/commit/143a16f35602be8561215611582211dec280cae6
• https://github.com/adonisjs/bodyparser/commit/6795c0e3fa824ae275bbd992aae60609e96f0f03
• https://github.com/adonisjs/bodyparser/releases/tag/v10.1.2
• https://github.com/adonisjs/bodyparser/releases/tag/v11.0.0-next.6
• https://github.com/adonisjs/core/security/advisories/GHSA-gvq6-hvvp-h34h

Published

Jan 2, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-21435webtransport-go is an implementation of the WebTransport pro…7.5
• CVE-2026-21436eopkg is a Solus package manager implemented in python3. In …5.5
• CVE-2026-21437eopkg is a Solus package manager implemented in python3. In …5.5
• CVE-2026-21438webtransport-go is an implementation of the WebTransport pro…5.3
• CVE-2026-21439badkeys is a tool and library for checking cryptographic pub…5.3
• CVE-2026-2144The Magic Login Mail or QR Code plugin for WordPress is vuln…8.1
• CVE-2026-21441urllib3 is an HTTP client library for Python. urllib3's stre…7.5
• CVE-2026-21443OpenEMR is a free and open source electronic health records …6.1
• CVE-2026-21444libtpms, a library that provides software emulation of a Tru…5.5
• CVE-2026-21445Langflow is a tool for building and deploying AI-powered age…9.1
• CVE-2026-21446Bagisto is an open source laravel eCommerce platform. In ver…9.8
• CVE-2026-21447Bagisto is an open source laravel eCommerce platform. Prior …7.1