Laranode CVE-2026-100520

Requires a valid authenticated Laranode tenant account (PR:L) with access to the file manager upload feature, and a multi-tenant deployment where tenants share a host so that traversal into another tenant's home/web root is meaningful. The attacker supplies directory-traversal sequences in the path parameter of POST /filemanager/upload-file; pre-1.2.1 the endpoint concatenated user input directly ('/home/'+systemUsername+'/'+path) with no normalization or containment, so no special non-default configuration is needed beyond having the file manager enabled. Limiting factors: authentication is required (not unauthenticated), and full impact (code execution as another tenant) assumes the written PHP lands where the web server serves and interprets it; a single-tenant install limits the blast radius to the attacker's own account.

The vendor CVSS 4.0 base of 8.7 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) aligns well with the described mechanics: a network-reachable, low-complexity path traversal in the authenticated POST /filemanager/upload-file endpoint that lets any tenant write PHP into another tenant's web root and achieve code execution as that tenant. The PR:L (authenticated tenant) is the main gating factor - this is not an unauthenticated internet-wide bug, but any legitimate hosting-panel customer is a valid attacker, and in a shared multi-tenant panel the trust boundary between tenants is exactly what is broken. No EPSS score, CISA KEV entry, or public POC is present in the supplied data, so this is NOT confirmed to be under active exploitation; the intelligence here is a credible third-party report (VulnCheck) plus a confirmed vendor patch (PR #21 / commit 5c2b18ae / v1.2.1 release) rather than observed exploitation. Real-world priority is therefore driven by impact-per-exploit (cross-tenant RCE, trivially weaponized by planting a webshell) rather than by exploitation-in-the-wild evidence or by broad exposure - the product itself is niche. Note the vendor scored subsequent-system impact as SC:N/SI:N/SA:N even though the described outcome is compromise of OTHER tenants; that under-represents the cross-security-authority nature of the flaw versus a CVSS 3.1 scope-change reading.

An attacker holds (or registers) a low-privileged tenant account on a shared Laranode host, then calls POST /filemanager/upload-file with directory-traversal sequences in the path parameter to escape their home directory and write a PHP webshell into a neighboring tenant's public web root. Requesting that planted file over HTTP executes attacker code in the victim tenant's context, fully compromising that tenant's site and data. No public POC is identified in the provided data, but the technique is trivial to reproduce from the confirmed patch diff.