CVE-2026-82460: Cloud Commander before 19.20.2 Directory Traversal via REST and Markdown
Cloud Commander before 19.20.2 contains a directory traversal vulnerability in REST file-operation and markdown endpoints that fails to properly validate path normalization. Attackers can use path traversal sequences to read, write, move, or copy files outside the configured root directory.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Cloud Commanderto a version that resolves this vulnerability.Fixed in 19.20.2
Event History
Frequently Asked Questions
Which deployments are exposed?
Cloud Commander versions before 19.20.2 are affected. Exposure applies where the REST file-operation or markdown endpoints are reachable by an attacker.
What does an attacker need to exploit this issue?
The issue is remotely exploitable with low attack complexity and requires no privileges or user interaction. An attacker uses path traversal sequences against affected endpoints.
What can an attacker do if exploitation succeeds?
An attacker can operate on files outside the configured root directory, including reading, writing, moving, or copying them. The vulnerability is rated critical with high impact to confidentiality, integrity, and availability.
What is the remediation?
Update Cloud Commander to version 19.20.2 or later. The affected versions are those before 19.20.2.