CVE-2026-110690: Cloud Commander 19.20.2 through 19.21.1 Path Traversal via GET /api/v1/pack
Cloud Commander (cloudcmd) versions 19.20.2 through 19.21.1 contains a path traversal vulnerability in the GET /api/v1/pack endpoint where the onGET handler at server/rest/index.js:130 calls the unguarded root() function instead of the root.resolve() validation wrapper used elsewhere. Attackers can send percent-encoded directory traversal sequences in the pack request path to read arbitrary files outside the configured --root directory, such as /etc/passwd or SSH private keys, which are archived and streamed back as a downloadable tar.gz file.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An unauthenticated remote attacker can exploit it because the vulnerability has network access, low attack complexity, no required privileges, and no user interaction.
What information could be exposed?
An attacker can read files outside the configured --root directory. The affected endpoint packages the requested files into a downloadable tar.gz archive; examples include /etc/passwd and SSH private keys.
How can I determine whether an installation is affected?
Cloud Commander versions 19.20.2 through 19.21.1 are affected. The issue is present when GET /api/v1/pack is available and processes percent-encoded directory-traversal sequences without resolving them through the validation wrapper.
What version addresses the issue?
The referenced Cloud Commander v19.21.2 release and associated commit are the available remediation references. Installations in the affected 19.20.2 through 19.21.1 range should be updated to the fixed release.