Read the docs
TI-2026-73989 Aliases CVE-2026-110690GHSA-3rxx-xp85-4r8j

Path traversal in Cloud Commander lets attackers read files

Priority MEDIUM 45CWE-23Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-23 and the CVSS impact.

Summary

Cloud Commander (cloudcmd) versions from 19.20.2 before 19.21.2 contain a path traversal flaw in the GET /api/v1/pack endpoint. The onGET handler calls root() without the validation wrapper used elsewhere, so percent-encoded traversal sequences in the request path are not blocked (CWE-23). An unauthenticated remote attacker can read arbitrary files outside the configured root directory, such as /etc/passwd, which are returned as a downloadable tar.gz archive.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

Cloud Commander (cloudcmd) versions 19.20.2 through 19.21.1 contains a path traversal vulnerability in the GET /api/v1/pack endpoint where the onGET handler at server/rest/index.js:130 calls the unguarded root() function instead of the root.resolve() validation wrapper used elsewhere. Attackers can send percent-encoded directory traversal sequences in the pack request path to read arbitrary files outside the configured --root directory, such as /etc/passwd or SSH private keys, which are archived and streamed back as a downloadable tar.gz file.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00897 59th percentileScored 2026-11-07
Fix Fixed cloudcmd (coderaiser): 19.21.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
coderaisercloudcmd19.20.2 to before 19.21.219.21.2Patch availableCNA
  • cloudcmd Vendorcoderaiser Affected 19.20.2 to before 19.21.2 Fixed in 19.21.2 Patch available CNA

Remediation

Update cloudcmd from coderaiser to version 19.21.2, which contains the fix.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA cloudcmd (coderaiser) Fixed in 19.21.2

Timeline

  1. 2026-10-14 Threatist record created from CVE-2026-110690
  2. 2026-10-14 Alias added: GHSA-3rxx-xp85-4r8j
  3. 2026-10-16 Priority changed: MEDIUM → LOW
  4. 2026-10-26 CISA SSVC decision points changed
  5. 2026-10-26 Priority changed: LOW → MEDIUM

References

Patch 2

Other 1

  • TI-2026-56854 Cloud Commander before 19.20.2 Directory Traversal via REST and Markdown CVSS 4.0CRITICAL 9.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences