CVE-2026-110690

Deferred Deferred - Pending Action

Path Traversal in Cloud Commander via Unsafe API Endpoint

Publication date: 2026-10-14

Last updated on: 2026-10-16

Assigner: VulnCheck

Description

Cloud Commander (cloudcmd) versions 19.20.2 through 19.21.1 contains a path traversal vulnerability in the GET /api/v1/pack endpoint where the onGET handler at server/rest/index.js:130 calls the unguarded root() function instead of the root.resolve() validation wrapper used elsewhere. Attackers can send percent-encoded directory traversal sequences in the pack request path to read arbitrary files outside the configured --root directory, such as /etc/passwd or SSH private keys, which are archived and streamed back as a downloadable tar.gz file.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-110690

EUVD

EUVD-2026-101027

Affected Vendors & Products

Vendor	Product	Version / Range
coderaiser	cloudcmd	19.20.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-23	The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as ".." that can resolve to a location that is outside of that directory.

Attack-Flow Graph

Executive Summary

This is a path traversal vulnerability in Cloud Commander (cloudcmd) versions 19.20.2 through 19.21.1. The issue is in the GET /api/v1/pack endpoint where the code uses an unguarded root() function instead of the validated root.resolve() wrapper. Attackers can send percent-encoded directory traversal sequences in the pack request path to read arbitrary files outside the configured root directory, such as /etc/passwd or SSH private keys. The files are then archived and returned as a downloadable tar.gz file.

Detection Guidance

To detect this vulnerability, check if Cloud Commander versions 19.20.2 through 19.21.1 are running. Use commands like 'curl -v http://<target>/api/v1/pack?pack=..%2f..%2f..%2fetc%2fpasswd' to test for path traversal. If the server responds with file contents, the system is vulnerable.

Impact Analysis

This vulnerability allows attackers to read sensitive files on the server outside the intended directory, potentially exposing confidential data like system files or private keys. If the server's root directory is misconfigured, attackers could access critical system files or user data, leading to unauthorized information disclosure.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements under GDPR (data protection) and HIPAA (health information privacy). Exposure of personal or health data may result in legal penalties, reputational damage, and loss of trust due to non-compliance with regulatory standards.

Mitigation Strategies

Upgrade Cloud Commander to version 19.21.2 or later. If upgrading is not possible, restrict access to the /api/v1/pack endpoint or disable it entirely. Ensure the --root directory is set to a non-system path to limit exposure.

Hi! I’m here to help you understand CVE-2026-110690. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70