Threat database

Cloud Commander (cloudcmd) versions 19.20.2 through 19.21.1 contain a path traversal vulnerability in the GET /api/v1/pack endpoint. The vulnerability arises because the onGET handler calls an unguarded root() function instead of the validated root.resolve() wrapper, allowing attackers to send percent-encoded directory traversal sequences. This enables reading arbitrary files outside the configured root directory, including sensitive files like /etc/passwd or SSH private keys, which are then archived and streamed back as a downloadable tar.gz file.

Cloud Commander versions before 19.20.2 have a directory traversal vulnerability in REST file-operation and markdown endpoints. This flaw allows attackers to bypass path normalization checks and perform unauthorized file operations outside the intended root directory. The vulnerability is critical with a CVSS score of 9.3, indicating high impact and ease of exploitation. No official patch or remediation details are currently confirmed.