{"vulnerability": "CVE-2026-100520", "sightings": [{"uuid": "675db367-45c3-4f2d-a718-2ed32e1346a9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-100520", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mwfd3s34p52n", "content": "\ud83d\udfe0 CVE-2026-100520 - High (8.8)\n\nLaranode versions before 1.2.1 contain a path traversal vulnerability in the POST /filemanager/up...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-100520/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-09-26T03:16:51.621018Z"}, {"uuid": "0501d1d1-63b1-4ffb-b1ff-6d2486bbb48e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-100520", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/a24y6m4nk57sm", "content": "CVE-2026-100520 - Laranode before 1.2.1 Path Traversal in File Manager Upload Endpoint\nCVE ID : CVE-2026-100520\n \n Published : Sept. 26, 2026, 1:17 a.m. | 32\u00a0minutes ago\n \n Description : Laranode versions before 1.2.1 contain a path traversal vulnerability in the POST /fileman...", "creation_timestamp": "2026-09-26T02:07:06.810828Z"}, {"uuid": "1cc98169-928e-48d4-a39a-42f033258619", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-100520", "type": "seen", "source": "https://gist.github.com/ichintu/649a1fe76b80e5c473482da09368e350", "content": "On September 26, 2026, two high-severity vulnerabilities were disclosed: **CVE-2026-100530** affects OpenClaw (pre-2026.8.1), allowing approved commands to bypass directory context and execute against unreviewed files (Severity: 8.5), while **CVE-2026-100520** impacts Laranode (pre-1.2.1), enabling authenticated users to exploit path traversal in file uploads to deploy cross-tenant code (Severity: 8.8). Both require immediate patching.", "creation_timestamp": "2026-09-26T04:00:21.000000Z"}, {"uuid": "1c6cff20-850c-4f3f-9ea8-43b35a5e53ce", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-100520", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mwh3pl7new2o", "content": "CVE-2026-100520 - laranode\nVersions of Laranode older than 1.2.1 let a signed\u2011in user upload files to locations outside their own folder. By tricking the system with special path strings, an attacker could\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#laranode #crivion #CVE #infosec", "creation_timestamp": "2026-09-26T20:10:03.743751Z"}, {"uuid": "ca5f4426-8cf6-4f40-aa9a-19d7ccaef694", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-100520", "type": "seen", "source": "https://t.me/GithubRedTeam/104036", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #RCE #CVE #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-100520-laranode-path-traversal\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a wvllxe\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-10-02 09:02:51\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nPath Traversal -> RCE in Laranode < 1.2.1 (CWE-22). PoC + advisory writeup.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-10-02T09:03:55.000000Z"}, {"uuid": "063d3765-7d7e-454b-9416-901a131859f7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-100520", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/104036", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #RCE #CVE #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-100520-laranode-path-traversal\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a wvllxe\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-10-02 09:02:51\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nPath Traversal -> RCE in Laranode < 1.2.1 (CWE-22). PoC + advisory writeup.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-10-02T09:03:55.000000Z"}]}