CVE-2026-21440: Path Traversal in AdonisJS

CVE-2026-21440 is a path traversal vulnerability in the multipart file handling of @adonisjs/bodyparser, a critical component of the AdonisJS framework (TypeScript-first web framework). The flaw allows an unauthenticated remote attacker to write arbitrary files to arbitrary filesystem locations on the server, bypassing the path constraints normally enforced by the file upload middleware.

CVSS score is 9.2 (critical). Affected versions are @adonisjs/bodyparser ≤10.1.1 and 11.x prerelease versions prior to 11.0.0-next.6. Patches were released by maintainers on January 2, 2026 (versions 10.1.2 and 11.0.0-next.6), however a report of a public technical reproduction lab dates to today (November 4, 2026), confirming the vector remains operational and documented.

Primary defense is immediate update to @adonisjs/bodyparser 10.1.2 or 11.0.0-next.6+. In environments where patching is not immediately feasible, enforce strict controls on file upload flow, restrict file extensions and destination locations, and validate all paths with a whitelist. Monitor access and filesystem logs for traversal attempts (../, ./, absolute paths) in upload parameters.