Executive Summary
CVE-2026-82460 affects Cloud Commander (coderaiser/cloudcmd), a browser-based file manager, in versions before 19.20.2. The flaw is a path traversal vulnerability (CWE-22) in the tool's REST file-operation and markdown-rendering endpoints, allowing attackers to escape the configured root directory entirely.
CVSS Score: 9.8 (Critical) — CVSS 4.0: 9.3
Cloud Commander's REST API and markdown viewer accept user-supplied file paths without properly normalizing or rejecting traversal sequences such as ../. Because the validation gap sits in the path-resolution layer shared by multiple endpoints, an attacker can manipulate requests to read, write, move, or copy files anywhere on the filesystem that the Cloud Commander process can access — well outside the directory an administrator intended to expose.
Vulnerability Overview
| Attribute | Value |
|---|---|
| CVE ID | CVE-2026-82460 |
| CVSS Score | 9.8 (Critical) — CVSS 4.0: 9.3 |
| Type | Improper Limitation of a Pathname to a Restricted Directory / Path Traversal (CWE-22) |
| Attack Vector | Network |
| Privileges Required | None |
| Affected Components | REST file-operation endpoints, markdown-rendering endpoint |
| Assigner | VulnCheck |
Affected Versions
| Product | Affected Versions | Fixed Version |
|---|---|---|
| Cloud Commander (cloudcmd) | Before 19.20.2 | 19.20.2 |
Technical Details
Cloud Commander exposes a REST API for file operations (read, write, move, copy) and a markdown-rendering endpoint that both accept a file path as user input, scoped to a configured root directory. The underlying path-resolution logic failed to properly normalize traversal sequences before checking whether the resolved path stayed within that root — meaning path segments like ../ were not stripped or rejected before the filesystem call executed.
Attack Vector
1. Attacker identifies a Cloud Commander instance exposed to the network
2. Attacker sends a REST file-operation or markdown-render request with
a path containing traversal sequences, e.g. ../../../../etc/passwd
3. Cloud Commander fails to normalize/reject the traversal sequence
4. The file operation resolves to a path outside the configured root
5. Attacker reads, writes, moves, or copies the target fileImpact of Successful Exploitation
| Impact Area | Description |
|---|---|
| Arbitrary File Read | Attackers can retrieve configuration files, credentials, SSH keys, or other sensitive data outside the intended root |
| Arbitrary File Write | Write/copy/move primitives can be used to plant or overwrite files, including web-accessible scripts, for further compromise |
| No Authentication Required | The affected REST and markdown endpoints do not require prior authentication to trigger the traversal |
| Full-System Exposure | Impact is bounded only by the filesystem permissions of the account running Cloud Commander |
Immediate Remediation
Step 1: Upgrade Cloud Commander
npm outdated cloudcmd
npm install cloudcmd@latest
# Confirm the installed version is 19.20.2 or later
cloudcmd --versionStep 2: Restrict Network Exposure
If an immediate upgrade isn't possible, ensure Cloud Commander instances are not reachable from the public internet — bind to localhost or place behind an authenticated reverse proxy / VPN.
Step 3: Review File Access Logs
# Look for traversal sequences in Cloud Commander access logs
grep -E '\.\./|%2e%2e' /var/log/cloudcmd/access.logStep 4: Audit for Prior Exploitation
Check for unexpected file reads/writes outside the configured Cloud Commander root, and rotate any credentials or keys that may have been exposed to a file-read outside root.
Detection Indicators
| Indicator | Description |
|---|---|
../ or URL-encoded (%2e%2e%2f) sequences in REST/markdown request paths | Direct evidence of a traversal attempt |
| File operations targeting paths outside the configured Cloud Commander root | Sign of successful exploitation |
| Unexpected new or modified files in system directories on hosts running Cloud Commander | Possible post-exploitation persistence |
Post-Remediation Steps
- Confirm the deployed version is 19.20.2 or later.
- Rotate credentials and keys that were stored on disk and potentially reachable via the traversal.
- Review access logs retroactively for traversal-pattern requests predating the patch.
- Restrict network exposure of file-manager tooling like Cloud Commander to trusted networks going forward, independent of this fix.
- Add path-normalization checks as a standing review item for any self-hosted file-manager or IDE-style web tooling.