CVE-2026-82460

Description

Cloud Commander before 19.20.2 contains a directory traversal vulnerability in REST file-operation and markdown endpoints that fails to properly validate path normalization. Attackers can use path traversal sequences to read, write, move, or copy files outside the configured root directory.

References

• https://github.com/coderaiser/cloudcmd
• https://github.com/coderaiser/cloudcmd/blob/v19.20.1/server/root.js
• https://github.com/coderaiser/cloudcmd/commit/b9bdc9ed528350eeb2f9ef974c18998096fae919
• https://github.com/coderaiser/cloudcmd/issues/474
• https://github.com/coderaiser/cloudcmd/releases/tag/v19.20.2