CVE-2026-21440: New AdonisJS 9.2 Critical Flaw Allows Arbitrary File Writes and RCE

CVE-2026-21440 has been identified as a critical flaw in AdonisJS 9.2 that could allow arbitrary file writes and remote code execution (RCE). The vulnerability resides in the framework’s file upload handling, specifically within the @adonisjs/bodyparser package used to parse multipart form data.

It stems from a dangerous default in which MultipartFile[.]move(location, options) builds the destination by joining the unsanitised client filename with the target directory when options[.]name is not provided, enabling traversal sequences such as ../../ to escape the intended directory. With default settings, options[.]overwrite defaults to true, allowing file overwrites that could overwrite application code, startup scripts or configuration files, potentially enabling RCE depending on permissions and deployment.

The issue affects @adonisjs/bodyparser up to version 10.1.1 and 11.x prerelease versions prior to 11.0.0-next.6, with fixes available in 10.1.2 and 11.0.0-next.6. Developers are urged to update to these versions to mitigate the risk. 5 January 2026.