CVE-2026-110690

7.5High

Published 14 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

7.5High

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None
Impact: High impact on confidentiality
Weakness: CWE-23

Impact

Unauthenticated remote attackers can read arbitrary server files outside the configured root directory, such as /etc/passwd or SSH keys. They only need network access to send a crafted GET request to the /api/v1/pack endpoint.

Root cause

The GET /api/v1/pack handler uses the unguarded root() function instead of the root.resolve() validation wrapper, failing to sanitize percent-encoded directory traversal sequences.

Affected systems

Cloud Commander (cloudcmd) 19.20.2 through 19.21.1

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Fix & remediation

Upgrade to Cloud Commander version 19.21.2 or later. If upgrading immediately is not possible, restrict or block network access to the GET /api/v1/pack endpoint via a reverse proxy or firewall.

shell

$ npm install -g cloudcmd@19.21.2

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Cloud Commander (cloudcmd) versions 19.20.2 through 19.21.1 contains a path traversal vulnerability in the GET /api/v1/pack endpoint where the onGET handler at server/rest/index.js:130 calls the unguarded root() function instead of the root.resolve() validation wrapper used elsewhere. Attackers can send percent-encoded directory traversal sequences in the pack request path to read arbitrary files outside the configured --root directory, such as /etc/passwd or SSH private keys, which are archived and streamed back as a downloadable tar.gz file.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-110690