A path traversal flaw in AdonisJS multipart file handling allows a remote attacker to write arbitrary files to any location on the server’s filesystem. The vulnerability is a classic file‑write vulnerability (CWE‑22) and can be leveraged to inject malicious scripts, overwrite configuration files, or deploy web shells, thereby providing a vector for remote code execution or system compromise.

The flaw affects AdonisJS core’s bodyparser module. Vulnerable versions include @adonisjs/bodyparser v10.1.1 and all 11.x pre‑release releases prior to 11.0.0‑next.6. The issue has been fixed in v10.1.2 and 11.0.0‑next.6.

The CVSS score of 9.2 marks this as a critical vulnerability, yet the EPSS score of less than 1% indicates a very low exploitation probability at the time of analysis. The flaw was not listed in the CISA KEV catalog. An attacker can exploit it over HTTP by crafting a multipart/form-data request with a manipulated filename containing path‑traversal tokens such as "../" to write files outside the intended upload directory. Successful exploitation typically requires the web application to run with file‑write permissions and may not necessitate additional privileges, making it a high‑risk but low‑prevalence threat.