Cloud Commander Through Path Traversal Via Get Api V1 Pack

Back www.vulncheck.com

Cloud Commander Through Path Traversal Via Get Api V1 Pack

www.vulncheck.com • October 15, 2026

Share: View original

Ready to get Started?

Vulnerability Prioritization Prioritize vulnerabilities that matter based on the threat landscape and defer vulnerabilities that don't.

Early Warning System Real-time alerting of changes in the vulnerability landscape so that you can take action before the attacks start.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

High-Risk Path Traversal Vulnerability in Cloud Commander Disclosed A path traversal vulnerability identified as CVE-2026-110690 affects Cloud Commander (cloudcmd) versions 19.20.2 to 19.21.1. This flaw allows unauthenticated attackers to exploit the GET /api/v1/pack endpoint, enabling them to read arbitrary files outside the configured root directory, including sensitive files like /etc/passwd. The vulnerability is rated as high risk due to the potential exposure of credentials and sensitive data. Attackers can send crafted traversal paths without needing user authentication. The flaw was published on October 14, 2026, and while it is not confirmed to be, remediation is urgently recommended. Users are advised to upgrade to the fixed release or restrict access to the vulnerable endpoint until patched. 1 sources 65

Extracted Entities

CWE Weaknesses (1)

CWE-22 - Path Traversal