Critical AdonisJS Bodyparser Flaw (CVSS 9.2) Enables Arbitrary File Write on Servers

Tracked as CVE-2026-21440 (CVSS score: 9.2), the flaw affects the AdonisJS multipart file handling mechanism and could allow a remote attacker to write arbitrary files on the server if exploited through a reachable upload endpoint, according to AdonisJS.

The vulnerability centres on the MultipartFile[.]move(location, options) function, where the name parameter defaults to an unsanitised client filename if not provided, enabling path traversal and potential overwriting of sensitive files if the overwrite flag is true. If an attacker can overwrite application code, startup scripts, or configuration files that are later executed, remote code execution is possible, according to AdonisJS.

The advisory notes affected versions include <= 10.1.1 (fixed in 10.1.2) and <= 11.0.0-next.5 (fixed in 11.0.0-next.6). This discovery complements ongoing security disclosures in the Node.js/npm ecosystem, including a related path traversal issue in the jsPDF library (CVE-2025-68428, CVSS 9.2), which was patched in version 4.0.0 released on 3 January 2026.