CVE-2026-82460: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in coderaiser cloudcmd

CVE-2026-82460 describes a directory traversal vulnerability in Cloud Commander prior to version 19.20.2. The issue exists because the REST file-operation and markdown endpoints do not properly validate path normalization, enabling attackers to use path traversal sequences to read, write, move, or copy files outside the configured root directory. This can lead to unauthorized access and modification of files beyond the intended scope.

Successful exploitation can allow unauthenticated attackers to access and manipulate files outside the designated root directory, potentially leading to data disclosure, data modification, or disruption of service. The vulnerability has a critical severity rating with a CVSS 4.0 score of 9.3, reflecting network attack vector, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected endpoints and monitor for suspicious activity. Avoid exposing the vulnerable versions publicly.