Cloud Commander before 19.20.2 contains a directory traversal vulnerability in REST file-operation and markdown endpoints that fails to properly validate path normalization.
CVSS 4.0CRITICAL 9.3·Network·No auth·No interaction·EPSS 0.00896·Published 2026-08-29·Fixed in 19.20.2CWE-22
Cloud Commander (cloudcmd) versions 19.20.2 through 19.21.1 contains a path traversal vulnerability in the GET /api/v1/pack endpoint where the onGET handler at server/rest/index.js:130 calls the unguarded root() function…
CVSS 4.0HIGH 8.7·Network·No auth·No interaction·EPSS 0.00897·Published 2026-10-14·Fixed in 19.21.2CWE-23