CVE-2026-82460

Published: Aug 29, 2026Modified: Aug 31, 2026

9.3

Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Show more

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: disclosure@vulncheck.com (Secondary)

Description

Cloud Commander before 19.20.2 contains a directory traversal vulnerability in REST file-operation and markdown endpoints that fails to properly validate path normalization. Attackers can use path traversal sequences to read, write, move, or copy files outside the configured root directory.

Related CWEs

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

References (7)

https://github.com/coderaiser/cloudcmd

Source: disclosure@vulncheck.com

https://github.com/coderaiser/cloudcmd/blob/v19.20.1/server/root.js

Source: disclosure@vulncheck.com

https://github.com/coderaiser/cloudcmd/commit/b9bdc9ed528350eeb2f9ef974c18998096fae919

Source: disclosure@vulncheck.com

https://github.com/coderaiser/cloudcmd/issues/474

Source: disclosure@vulncheck.com

https://github.com/coderaiser/cloudcmd/releases/tag/v19.20.2

Source: disclosure@vulncheck.com

https://www.vulncheck.com/advisories/cloud-commander-before-19.20.2-directory-traversal-via-rest-and-markdown

Source: disclosure@vulncheck.com

https://github.com/coderaiser/cloudcmd/issues/474

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Timeline

No history available yet.