CVE-2026-21440Disclosure

LOWCVSS 9.2 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

AdonisJS is a TypeScript-first web framework. A Path Traversal vulnerability in AdonisJS multipart file handling may allow a remote attacker to write arbitrary files to arbitrary locations on the server filesystem. This impacts @adonisjs/bodyparser through version 10.1.1 and 11.x prerelease versions prior to 11.0.0-next.6. This issue has been patched in @adonisjs/bodyparser versions 10.1.2 and 11.0.0-next.6.

Back to dashboard

0.5/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-22

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

Patch or workaround signal is available
2 mentions across 2 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 1 signal
Disclosure: 1 classified signal
Peaked 1d ago at 1 mentions (2026-02-05); latest day: 1
2 total mentions across 2 days

Deep dive

Activity timeline2 mentions / 2d

Signal classification2 categories

Disclosure

150.0%

Patch

150.0%

Referenced assets1 URL

By indicator

https://securityonline.info/cve-2026-21440-new-adonisjs-9-2-critical-flaw-allows-arbitrary-file-writes-and-rce/?utm_source=dlvr.it&utm_medium=twitter

Classification over time

Date	Total	Labels

2026-02-05	1	Disclosure1
2026-08-03	1	Patch1

Full discourse2 posts

المحارب🏆🇦🇪🇪🇬@nike4942467d
Patch
@cybersecurity 🔥 عينة لأبرز 5 ثغرات مفهرسة ومرفقة بالحلول من داخل التقرير: 1. CVE-2025-13952 (مرفق معها ترقيع برلمجي C++ Patch) 2. CVE-2025-68717 (مرفق معها وثيقة ZayedShield Doc) 3. CVE-2026-25761 (تحليل أمني متقدم لعام 2026) 4. CVE-2025-55182 (تأمين الخدمات البنيوية) 5. CVE-2026-21440 (بلاغ
Post summary
The post lists five CVE identifiers and notes that solutions are included, specifically mentioning a C++ patch for CVE‑2025‑13952. It primarily focuses on remediation rather than exploitation or disclosure details.
0000048
52 followersView on X
Komodo Cyber Security@Komodosec245d
Disclosure
#VulnerabilityReport #adonisjsbodyparser CVE-2026-21440: New AdonisJS 9.2 Critical Flaw Allows Arbitrary File Writes and RCE https://securityonline.info/cve-2026-21440-new-adonisjs-9-2-critical-flaw-allows-arbitrary-file-writes-and-rce/?utm_source=dlvr.it&utm_medium=twitter
Post summary
The tweet announces CVE-2026-21440, a critical flaw in AdonisJS 9.2 that permits arbitrary file writes and remote code execution.
0000069
1.5K followersView on X

Explore more

Back to dashboard