Executive brief
AdonisJS BodyParser is a library used by AdonisJS web applications to handle file uploads from HTML forms. A path traversal vulnerability allows attackers to upload files to arbitrary locations on the server, potentially overwriting application code or configuration files and leading to remote code execution. This affects any AdonisJS application using the vulnerable versions of BodyParser without explicit filename sanitization.
Technical details
A path traversal vulnerability (CWE-22) exists in the MultipartFile.move() method of @adonisjs/bodyparser. When developers call move(location, options) without providing options.name or without sanitizing filenames, the method defaults to using the unsanitized client-supplied filename and constructs the destination path with path.join(location, name), allowing traversal sequences (../) to escape the intended upload directory. Additionally, options.overwrite defaults to true, enabling file overwrites. Attack requires a reachable upload endpoint and application code using move() without proper filename sanitization. An attacker can supply crafted filenames with traversal sequences to write arbitrary files; if these files are application code, startup scripts, or configuration files that are later executed, remote code execution becomes possible. Patches are available: v10.1.2 and v11.0.0-next.6.
Affected products
- AdonisJS BodyParser through 10.1.1 and 11.x prerelease prior to 11.0.0-next.6
Timeline
- 2026-01-02: disclosed: Published on GitHub advisories and OSV
- 2026-01-02: patched: Patches released: v10.1.2 and v11.0.0-next.6