Cloud Commander (cloudcmd) versions 19.20.2 through 19.21.1 contains a path traversal vulnerability in the GET /api/v1/pack endpoint where the onGET handler at server/rest/index.js:130 calls the unguarded root() function instead of the root.resolve() validation wrapper used elsewhere. Attackers can send percent-encoded directory traversal sequences in the pack request path to read arbitrary files outside the configured --root directory, such as /etc/passwd or SSH private keys, which are archived and streamed back as a downloadable tar.gz file.

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
coderaiser cloudcmd unaffected
Version Status Constraints
19.20.2 affected < 19.21.2

No data.

No data.

No data.

Project Subscriptions

Vendors Products
Coderaiser Subscribe
Cloudcmd Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://gist.github.com/mansurmavlankulov/5a0c4cbab8e49ac0669d126c854da95e cve-icon cve-icon
https://github.com/coderaiser/cloudcmd/commit/91c024591f425e26200884d5e1d5ba972377968b cve-icon cve-icon
https://github.com/coderaiser/cloudcmd/releases/tag/v19.21.2 cve-icon cve-icon
https://www.vulncheck.com/advisories/cloud-commander-through-path-traversal-via-get-api-v1-pack cve-icon cve-icon
History

Wed, 14 Oct 2026 14:00:00 +0000

Type Values Removed Values Added
Description Cloud Commander (cloudcmd) versions 19.20.2 through 19.21.1 contains a path traversal vulnerability in the GET /api/v1/pack endpoint where the onGET handler at server/rest/index.js:130 calls the unguarded root() function instead of the root.resolve() validation wrapper used elsewhere. Attackers can send percent-encoded directory traversal sequences in the pack request path to read arbitrary files outside the configured --root directory, such as /etc/passwd or SSH private keys, which are archived and streamed back as a downloadable tar.gz file.
Title Cloud Commander 19.20.2 through 19.21.1 Path Traversal via GET /api/v1/pack
First Time appeared Coderaiser
Coderaiser cloudcmd
Weaknesses CWE-23
CPEs cpe:2.3:a:coderaiser:cloudcmd:*:*:*:*:*:*:*:*
Vendors & Products Coderaiser
Coderaiser cloudcmd
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'}

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-14T13:45:19.632Z

Reserved: 2026-10-14T13:37:25.706Z

Link: CVE-2026-110690

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-14T14:17:44.140

Modified: 2026-10-14T14:17:44.140

Link: CVE-2026-110690

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses