---
title: "CVE-2026-21440: AdonisJS Path Traversal in Multipart File Handling"
url: https://erroneo.us/security/cve/CVE-2026-21440/
description: "CVE-2026-21440 (@adonisjs/bodyparser (npm)): AdonisJS is a TypeScript-first web framework. A Path Traversal vulnerability in AdonisJS multipart file…"
type: vulnerability-record
section: "Security Digest"
date_published: 2026-01-02
date_modified: 2026-01-05
publisher: erroneo.us
author: erroneo.us Security Desk
cve: "CVE-2026-21440"
kev: false
cvss: 9.2
epss: 0.01034
license: All rights reserved. Quote with attribution and a link.
---

# CVE-2026-21440: AdonisJS Path Traversal in Multipart File Handling

**Signal:** Critical and remotely reachable. No known exploitation yet, but it is network-reachable without credentials. (Computed from CISA KEV, EPSS and CVSS; not an editorial verdict.)

## Should you act?

- No confirmed exploitation. It is not in CISA’s KEV catalog and CISA’s SSVC assessment records no known exploitation. That can change quickly after a public write-up; re-check if you are affected.
- EPSS 1.0% , percentile 63: FIRST’s model estimates a 1.0% chance of exploitation activity in the next 30 days, higher than 63% of all scored CVEs (moderate). EPSS is a probability, not a verdict.
- Remotely reachable with no login and no user interaction. If the vulnerable service is exposed to the internet, prioritize it.
- Only applies if your dependency tree includes @adonisjs/bodyparser (npm) < 10.1.2, fixed in 10.1.2 ; @adonisjs/bodyparser (npm) >= 11.0.0-next.0, < 11.0.0-next.6, fixed in 11.0.0-next.6 . Check your lockfile, including transitive dependencies.

## What it is

AdonisJS is a TypeScript-first web framework. A Path Traversal vulnerability in AdonisJS multipart file handling may allow a remote attacker to write arbitrary files to arbitrary locations on the server filesystem. This impacts @adonisjs/bodyparser through version 10.1.1 and 11.x prerelease versions prior to 11.0.0-next.6. This issue has been patched in @adonisjs/bodyparser versions 10.1.2 and 11.0.0-next.6.

## Affected packages

- npm `@adonisjs/bodyparser` < 10.1.2 → fixed: 10.1.2
- npm `@adonisjs/bodyparser` >= 11.0.0-next.0, < 11.0.0-next.6 → fixed: 11.0.0-next.6

## Affected products (CVE record)

- adonisjs core: < 10.1.2, >= 11.0.0-next.0, < 11.0.0-next.6

## Severity

- GitHub_M CVSS 4.0: 9.2 `CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N`
- GitHub CVSS 4.0: 9.2 `CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N`

## Exploitation

- CISA KEV: not listed (no confirmed in-the-wild exploitation known to CISA).
- CISA SSVC assessment: exploitation none , automatable no , technical impact total .
- FIRST EPSS (model of 2026-10-21): 1.03% probability of exploitation activity in the next 30 days; percentile 63.

## Sources

- [GitHub Advisory GHSA-gvq6-hvvp-h34h](https://github.com/advisories/GHSA-gvq6-hvvp-h34h)
- [CVE.org record CVE-2026-21440](https://www.cve.org/CVERecord?id=CVE-2026-21440)
- [NVD entry CVE-2026-21440](https://nvd.nist.gov/vuln/detail/CVE-2026-21440)
- [github.com](https://github.com/adonisjs/core/security/advisories/GHSA-gvq6-hvvp-h34h)
- [github.com](https://github.com/adonisjs/bodyparser/commit/143a16f35602be8561215611582211dec280cae6)
- [github.com](https://github.com/adonisjs/bodyparser/commit/6795c0e3fa824ae275bbd992aae60609e96f0f03)
- [github.com](https://github.com/adonisjs/bodyparser/releases/tag/v10.1.2)
- [github.com](https://github.com/adonisjs/bodyparser/releases/tag/v11.0.0-next.6)

---
Source page: https://erroneo.us/security/cve/CVE-2026-21440/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt