{"vulnerability": "cve-2026-100520", "sightings": [{"uuid": "675db367-45c3-4f2d-a718-2ed32e1346a9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-100520", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mwfd3s34p52n", "content": "\ud83d\udfe0 CVE-2026-100520 - High (8.8)\n\nLaranode versions before 1.2.1 contain a path traversal vulnerability in the POST /filemanager/up...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-100520/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-09-26T03:16:51.621018Z"}, {"uuid": "0501d1d1-63b1-4ffb-b1ff-6d2486bbb48e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-100520", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/a24y6m4nk57sm", "content": "CVE-2026-100520 - Laranode before 1.2.1 Path Traversal in File Manager Upload Endpoint\nCVE ID : CVE-2026-100520\n \n Published : Sept. 26, 2026, 1:17 a.m. | 32\u00a0minutes ago\n \n Description : Laranode versions before 1.2.1 contain a path traversal vulnerability in the POST /fileman...", "creation_timestamp": "2026-09-26T02:07:06.810828Z"}, {"uuid": "1cc98169-928e-48d4-a39a-42f033258619", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-100520", "type": "seen", "source": "https://gist.github.com/ichintu/649a1fe76b80e5c473482da09368e350", "content": "On September 26, 2026, two high-severity vulnerabilities were disclosed: **CVE-2026-100530** affects OpenClaw (pre-2026.8.1), allowing approved commands to bypass directory context and execute against unreviewed files (Severity: 8.5), while **CVE-2026-100520** impacts Laranode (pre-1.2.1), enabling authenticated users to exploit path traversal in file uploads to deploy cross-tenant code (Severity: 8.8). Both require immediate patching.", "creation_timestamp": "2026-09-26T04:00:21.000000Z"}, {"uuid": "1c6cff20-850c-4f3f-9ea8-43b35a5e53ce", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-100520", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mwh3pl7new2o", "content": "CVE-2026-100520 - laranode\nVersions of Laranode older than 1.2.1 let a signed\u2011in user upload files to locations outside their own folder. By tricking the system with special path strings, an attacker could\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#laranode #crivion #CVE #infosec", "creation_timestamp": "2026-09-26T20:10:03.743751Z"}, {"uuid": "ca5f4426-8cf6-4f40-aa9a-19d7ccaef694", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-100520", "type": "seen", "source": "https://t.me/GithubRedTeam/104036", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #RCE #CVE #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-100520-laranode-path-traversal\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a wvllxe\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-10-02 09:02:51\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nPath Traversal -> RCE in Laranode < 1.2.1 (CWE-22). PoC + advisory writeup.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-10-02T09:03:55.000000Z"}, {"uuid": "063d3765-7d7e-454b-9416-901a131859f7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-100520", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/104036", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #RCE #CVE #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-100520-laranode-path-traversal\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a wvllxe\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-10-02 09:02:51\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nPath Traversal -> RCE in Laranode < 1.2.1 (CWE-22). PoC + advisory writeup.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-10-02T09:03:55.000000Z"}, {"uuid": "a5356db3-1832-42c3-8512-0a2c002a19b8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-100520", "type": "seen", "source": "https://infosec.exchange/users/DarkWebInformer/statuses/117379144190322897", "content": "\ud83d\udea8 Public PoC released for CVE-2026-100520 affecting Laranode\nhttps://github.com/wvllxe/CVE-2026-100520-laranode-path-traversal\nCVE-2026-100520 is a high-severity path traversal flaw in the Laranode multi-tenant hosting control panel that can let a low-privileged authenticated user write files outside their own home directory.\nA newly published proof of concept demonstrates how the issue can be chained into remote code execution by placing a PHP file inside another tenant\u2019s web root.\nKey details:\u2800\u2022 CVE-2026-100520\u2022 CVSS 3.1: 8.8 HIGH\u2022 CVSS 4.0: 8.7 HIGH\u2022 CWE-22 Path Traversal\u2022 Authenticated exploitation required\u2022 Arbitrary file write\u2022 Cross-tenant impact\u2022 Remote code execution possible\u2022 Laranode versions before 1.2.1 affected\u2022 Fixed in version 1.2.1\u2800The vulnerability stems from attacker-controlled path values being used when constructing upload destinations without sufficient traversal protections. \nThe published PoC uses a valid low-privileged account and demonstrates writing a file into a sibling tenant\u2019s web root.\nThe issue was publicly disclosed on September 21, 2026, and the CVE was published on September 26. The vendor fix was released before the PoC became public.\n\ud83d\udca5 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing", "creation_timestamp": "2026-10-03T21:40:02.352694Z"}, {"uuid": "8a3f0ff1-61b7-42a8-a1e2-71523d720290", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-100520", "type": "seen", "source": "https://bsky.app/profile/cvemon.bsky.social/post/3mwz6bwgvmb2i", "content": "CVE-2026-100520 is trending. Hype score 8, currently #6 on cvemon.\n\nLaranode versions before 1.2.1 contain a path traversal vulnerability in the POST /filemanager/upload-file endpoint that allows authenticated users to write arbitrary files outside\u2026\n\nhttps://cvemon.intruder.io/cves/CVE-2026-100520", "creation_timestamp": "2026-10-04T00:44:03.183768Z"}]}