CVE-2026-82460

CriticalCVSS 9.8

Published: 29/08/2026(UTC)Updated: 24/09/2026(UTC)Translated: 29/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

0.90%

58th percentile - higher than 58% of all known CVEs

Summary

Cloud Commander before version 19.20.2 contains a directory traversal vulnerability in REST file-operation and markdown endpoints that fails to properly validate path normalization. Attackers can use path traversal sequences to read, write, move, or copy files outside the configured root directory.

Risk Assessment

The vulnerability allows unauthorized access to files outside the root directory, potentially leading to leakage of sensitive data or modification. This can compromise system integrity and information confidentiality.

Recommendation

Update Cloud Commander to version 19.20.2 or later that includes a fix. Restrict access to the application to trusted users and networks only.

Other vulnerabilities in Cloud Commander

CVE-2026-110690High
Cloud Commander versions 19.20.2 through 19.21.1 contain a path traversal vulnerability in the GET /api/v1/pack endpoint where the onGET handler calls the unguarded root() function instead of the root.resolve() validation wrapper. Attackers can use percent-encoded directory traversal sequences to read arbitrary files outside the configured --root directory, such as /etc/passwd or SSH private keys, which are archived and streamed back as a downloadable tar.gz file.

Original NVD description (English source)

Cloud Commander before 19.20.2 contains a directory traversal vulnerability in REST file-operation and markdown endpoints that fails to properly validate path normalization. Attackers can use path traversal sequences to read, write, move, or copy files outside the configured root directory.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS