Laranode
Monthly
Authenticated path traversal in Laranode before 1.2.1 lets any tenant holding a valid account and file manager access write arbitrary files outside their own home directory via the POST /filemanager/upload-file endpoint, including dropping PHP files into other tenants' web roots for code execution as those tenants. The endpoint built its destination as '/home/' + systemUsername + '/' + user-supplied path with no normalization or containment, so a low-complexity traversal request is sufficient on multi-tenant hosts where the web server interprets the written PHP; vendor CVSS 4.0 rates this 8.7 (AV:N/AC:L/AT:N/PR:L/UI:N) and our independent CVSS 3.1 assessment (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) equally reflects cross-tenant scope change. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (no CISA KEV entry); exploitation requires authentication, so single-tenant installations limit the blast radius to the attacker's own account.
Authenticated path traversal in Laranode before 1.2.1 lets any tenant holding a valid account and file manager access write arbitrary files outside their own home directory via the POST /filemanager/upload-file endpoint, including dropping PHP files into other tenants' web roots for code execution as those tenants. The endpoint built its destination as '/home/' + systemUsername + '/' + user-supplied path with no normalization or containment, so a low-complexity traversal request is sufficient on multi-tenant hosts where the web server interprets the written PHP; vendor CVSS 4.0 rates this 8.7 (AV:N/AC:L/AT:N/PR:L/UI:N) and our independent CVSS 3.1 assessment (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) equally reflects cross-tenant scope change. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (no CISA KEV entry); exploitation requires authentication, so single-tenant installations limit the blast radius to the attacker's own account.