x.comthreadNorsyx (@norsyx) on X
A tweet by @norsyx announces the public release of a proof-of-concept exploit for CVE-2026-100520, a high-severity path traversal vulnerability in Laranode, a multi-tenant hosting control panel. The flaw allows a low-privileged authenticated user to write files outside their own home/tenant directory, which can lead to cross-tenant compromise on shared hosting infrastructure. The linked GitHub repository hosts the PoC code.
TL;DR Public PoC dropped for CVE-2026-100520, a path traversal bug in Laranode letting low-priv users write files outside their tenant home.
CVEs named here
- CVE-2026-100520
Technologies named here
- CVE-2026-100520 PoC
- Laranode
Techniques named here
Related in AppSec
github.comadvisoryFlowise MCP Security Bypass Enables RCE
huntress.comwriteupInside an Oracle Database SQL Injection Attack | Huntress
github.comrepoOASIS
blog.trailofbits.comwriteup