{"uuid": "a5356db3-1832-42c3-8512-0a2c002a19b8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-100520", "type": "seen", "source": "https://infosec.exchange/users/DarkWebInformer/statuses/117379144190322897", "content": "\ud83d\udea8 Public PoC released for CVE-2026-100520 affecting Laranode\nhttps://github.com/wvllxe/CVE-2026-100520-laranode-path-traversal\nCVE-2026-100520 is a high-severity path traversal flaw in the Laranode multi-tenant hosting control panel that can let a low-privileged authenticated user write files outside their own home directory.\nA newly published proof of concept demonstrates how the issue can be chained into remote code execution by placing a PHP file inside another tenant\u2019s web root.\nKey details:\u2800\u2022 CVE-2026-100520\u2022 CVSS 3.1: 8.8 HIGH\u2022 CVSS 4.0: 8.7 HIGH\u2022 CWE-22 Path Traversal\u2022 Authenticated exploitation required\u2022 Arbitrary file write\u2022 Cross-tenant impact\u2022 Remote code execution possible\u2022 Laranode versions before 1.2.1 affected\u2022 Fixed in version 1.2.1\u2800The vulnerability stems from attacker-controlled path values being used when constructing upload destinations without sufficient traversal protections. \nThe published PoC uses a valid low-privileged account and demonstrates writing a file into a sibling tenant\u2019s web root.\nThe issue was publicly disclosed on September 21, 2026, and the CVE was published on September 26. The vendor fix was released before the PoC became public.\n\ud83d\udca5 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing", "creation_timestamp": "2026-10-03T21:40:02.352694Z"}