Cloud Commander before 19.20.2 Directory Traversal via REST and Markdown
Priority HIGH 81CWE-22Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
Cloud Commander before 19.20.2 contains a directory traversal vulnerability in REST file-operation and markdown endpoints that fails to properly validate path normalization. Attackers can use path traversal sequences to read, write, move, or copy files outside the configured root directory.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00896 59th percentileScored 2026-11-07
Fix Fixed cloudcmd (coderaiser): 19.20.2
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| coderaiser | cloudcmd | before 19.20.2 | 19.20.2 | Patch available | CNA |
- cloudcmd Vendorcoderaiser Affected before 19.20.2 Fixed in 19.20.2 Patch available CNA
Remediation
- Fix · CNA cloudcmd (coderaiser) Fixed in 19.20.2
Timeline
- 2026-10-02 Threatist record created from CVE-2026-82460
- 2026-10-03 Alias added: GHSA-cjr4-fpcr-5mvq
References
More coderaiser vulnerabilities
- TI-2026-73989 Path traversal in Cloud Commander lets attackers read files CVSS 4.0HIGH 8.7
Sources
- CVE-2026-82460 · CVE Program
- CVE-2026-82460 · NVD
- FIRST EPSS
- GHSA-cjr4-fpcr-5mvq · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences