CyberRota Analysis
AI-GeneratedLaranode versions prior to 1.2.1 are vulnerable to a path traversal flaw in the POST /filemanager/upload-file endpoint, enabling authenticated users to write arbitrary files outside their designated directories. This vulnerability allows attackers to exploit directory traversal sequences to upload PHP files into other tenants' web roots, potentially leading to unauthorized code execution. Organizations using Laranode should prioritize patching this vulnerability to mitigate the risk of tenant compromise and code execution.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Laranode versions before 1.2.1 contain a path traversal vulnerability in the POST /filemanager/upload-file endpoint that allows authenticated users to write arbitrary files outside their home directory. Attackers can supply directory traversal sequences in the path parameter to write PHP files into other tenants' web roots and execute code as those tenants.