A critical path traversal vulnerability in Crivion Laranode allows authenticated users to achieve remote code execution by writing arbitrary files to the web root.

The application fails to properly sanitize the path parameter within the POST /filemanager/upload-file endpoint, allowing an authenticated user to perform directory traversal and write files into unintended locations. This flaw enables the upload of malicious PHP files into other tenants' web directories.

The ability for a malicious actor to write arbitrary files and execute code on the server presents a severe risk to the entire multi-tenant infrastructure. Given the CVSS score of 8.8, this vulnerability allows for complete compromise of the affected tenant environment, potentially leading to unauthorized data access, service disruption, and lateral movement within the hosting platform.

Immediate Action: Update Crivion Laranode to version 1.2.1 or later immediately to apply the required path sanitization logic.

Proactive Monitoring: Review application logs for unusual file upload requests containing directory traversal sequences, such as dot-dot-slash patterns, directed toward the file manager endpoint.

Compensating Controls: Implement strict file system permissions and use a Web Application Firewall to filter and block requests containing directory traversal characters in the path parameter.

Public Exploit Available: Unknown

This vulnerability represents a significant security risk for Laranode deployments. Organizations must prioritize the upgrade to version 1.2.1 to prevent potential remote code execution attacks. Failure to patch this flaw leaves the application susceptible to full compromise by any authenticated user.