Path Traversal Vulnerability in Cloud Commander by Coderaiser
CVE-2026-110690
What is CVE-2026-110690?
Cloud Commander versions 19.20.2 to 19.21.1 have a path traversal vulnerability within the GET /api/v1/pack endpoint. The flaw arises because the onGET handler improperly uses an unguarded root() function, bypassing the necessary root.resolve() validation applied in other areas of the code. This vulnerability allows attackers to exploit percent-encoded directory traversal sequences in the pack request path, enabling unauthorized access to sensitive files outside the designated --root directory, including critical files like /etc/passwd and SSH private keys. Attackers can potentially download these files as a tar.gz archive, posing significant risks to the security of affected systems. Users are advised to update to version 19.21.2 or later to mitigate this issue.
Affected Version(s)
cloudcmd 19.20.2 < 19.21.2