CVE-2026-100520

CVE-2026-100520 is a path traversal vulnerability affecting Laranode, a multi-tenant application, in versions prior to 1.2.1. The issue resides in the `POST /filemanager/upload-file` endpoint, which is used for file management operations. It allows authenticated users to write arbitrary files outside of their designated home directory by manipulating the file upload path. To exploit this vulnerability, an attacker can input directory traversal sequences into the `path` parameter during a file upload. This allows them to write PHP files into the web roots of other tenants, leading to arbitrary code execution under the context of those tenants. The vulnerability has been resolved in Laranode version 1.2.1.