Is CVE-2026-21440 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-21440 being exploited in the wild.

How severe is CVE-2026-21440?

Medium severity, with a CVSS score of 4, published 2 January 2026.

Which products and versions are affected?

AdonisJS Bodyparser through 10.1.1 and 11.x prerelease prior to 11.0.0-next.6.

Is there a fix for CVE-2026-21440?

A patch was published on 2026-01-02: Patches released: v10.1.2 and v11.0.0-next.6 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-21440 attacked?

It is attacked over the network.

Am I affected by CVE-2026-21440?

Check whether you run AdonisJS Bodyparser at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-21440: AdonisJS BodyParser path traversal in file uploads

CVE-2026-21440 · Severity: medium · CVSS 4 · Published 2026-01-02

AdonisJS BodyParser is a library used by AdonisJS web applications to handle file uploads from HTML forms. A path traversal vulnerability allows attackers to upload files to arbitrary locations on the server, potentially overwriting application code or configuration files and leading to remote code execution. This affects any AdonisJS application using the vulnerable versions of BodyParser without explicit filename sanitization.

Technologies: AdonisJS Bodyparser. Vendors: AdonisJS.

Quick answers

Is CVE-2026-21440 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-21440 being exploited in the wild.
How severe is CVE-2026-21440?: Medium severity, with a CVSS score of 4, published 2 January 2026.
Which products and versions are affected?: AdonisJS Bodyparser through 10.1.1 and 11.x prerelease prior to 11.0.0-next.6.
Is there a fix for CVE-2026-21440?: A patch was published on 2026-01-02: Patches released: v10.1.2 and v11.0.0-next.6 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-21440 attacked?: It is attacked over the network.
Am I affected by CVE-2026-21440?: Check whether you run AdonisJS Bodyparser at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A path traversal vulnerability (CWE-22) exists in the MultipartFile.move() method of @adonisjs/bodyparser. When developers call move(location, options) without providing options.name or without sanitizing filenames, the method defaults to using the unsanitized client-supplied filename and constructs the destination path with path.join(location, name), allowing traversal sequences (../) to escape the intended upload directory. Additionally, options.overwrite defaults to true, enabling file overwrites. Attack requires a reachable upload endpoint and application code using move() without proper filename sanitization. An attacker can supply crafted filenames with traversal sequences to write arbitrary files; if these files are application code, startup scripts, or configuration files that are later executed, remote code execution becomes possible. Patches are available: v10.1.2 and v11.0.0-next.6.

Affected products

AdonisJS BodyParser through 10.1.1 and 11.x prerelease prior to 11.0.0-next.6

Identifiers

CVE-2026-21440
GHSA-gvq6-hvvp-h34h

Timeline

2026-01-02: disclosed: Published on GitHub advisories and OSV
2026-01-02: patched: Patches released: v10.1.2 and v11.0.0-next.6

References

https://github.com/adonisjs/core/security/advisories/GHSA-gvq6-hvvp-h34h

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.