CVE-2026-21440

Advanced detection-only PoC for CVE-2026-21440 affecting AdonisJS BodyParser. No exploitation included.

CVE-2026-21440 – AdonisJS Advanced Detection PoC

Description

This project provides an advanced detection-only Proof of Concept (PoC) for CVE-2026-21440,
a critical Path Traversal / Arbitrary File Write vulnerability affecting @adonisjs/bodyparser in AdonisJS applications.

⚠️ This tool DOES NOT exploit the vulnerability.
It is intended for fingerprinting, research, and defensive security analysis only.

About CVE-2026-21440

• Affected Framework: AdonisJS (Node.js)
• Component: @adonisjs/bodyparser
• Vulnerability Type: Path Traversal → Arbitrary File Write
• Severity: Critical (CVSS ~9.2)
• Root Cause: Unsafe handling of user-controlled filenames during file uploads

If exploited, this vulnerability may lead to:

• Arbitrary file write
• Application compromise
• Potential Remote Code Execution (RCE)

Purpose of This Tool

This PoC helps security researchers and defenders to:

• Identify potential AdonisJS applications
• Detect possible file upload surfaces
• Estimate the likelihood of CVE-2026-21440 exposure
• Perform safe, non-intrusive detection

What This PoC Does

✔ Fingerprints AdonisJS indicators (headers, body, stack traces)
✔ Detects Node.js / AdonisJS patterns
✔ Probes common upload endpoints using GET requests only
✔ Calculates a confidence score
✔ Outputs a risk level: LOW / MEDIUM / HIGH

What This PoC Does NOT Do

❌ No file uploads
❌ No path traversal attempts
❌ No payloads
❌ No exploitation
❌ No bypass techniques

Requirements

• Python 3.8+
• requests library

Install dependencies:

pip install requests





 Usage
python3 cve-2026-21440_detection.py https://target.com

Example Output
[!] Likelihood of CVE-2026-21440: HIGH
[i] Confidence Score: 7/10
[!] Target MAY be vulnerable
[!] Manual verification required


Author

Handle: @You_sse_f1

Role: Cybersecurity Researcher

X ; @You_sse_f1



image