CVE Alert: CVE-2026-110690 – coderaiser

Cloud Commander (cloudcmd) versions 19.20.2 through 19.21.1 contains a path traversal vulnerability in the GET /api/v1/pack endpoint where the onGET handler at server/rest/index.js:130 calls the unguarded root() function instead of the root.resolve() validation wrapper used elsewhere. Attackers can send percent-encoded directory traversal sequences in the pack request path to read arbitrary files outside the configured –root directory, such as /etc/passwd or SSH private keys, which are archived and streamed back as a downloadable tar.gz file.

**Risk verdict:** High risk for any internet- or network-reachable deployment; expedite remediation, although KEV and active-exploitation status are not provided.

**Why this matters:** An unauthenticated attacker may retrieve files beyond the configured content root, potentially exposing credentials, keys, configuration, and other sensitive data. Stolen secrets could support account compromise or access to connected systems; the flaw itself does not modify files or directly cross security boundaries.

**Most likely attack path:** An attacker sends a crafted traversal path to the exposed pack endpoint over the network; no account, user action, or unusual conditions are needed. The vulnerable service returns the requested files as an archive. Scope is unchanged, but recovered credentials may enable subsequent lateral movement.

**Who is most exposed:** Prioritise self-hosted instances exposed to the internet, especially those running with access to secrets or mounted host directories. Internal deployments are also at risk if reachable from untrusted user or workload networks.

Review web and proxy logs for unusual requests to the pack endpoint, especially encoded traversal sequences.

Look for unexpected archive downloads, response sizes, or repeated pack requests.

Check egress and endpoint telemetry for access to sensitive files by the service process.

Investigate subsequent use of any credentials or keys accessible to the service.

Mitigation and prioritisation:

Upgrade to the vendor’s fixed release; treat as an urgent patch for exposed instances.

Until patched, restrict endpoint access to trusted networks or disable the service where feasible.

Limit service filesystem permissions and remove unnecessary sensitive mounts.

Rotate potentially exposed secrets after investigating access; use a controlled change window and verify service operation afterward.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.