EUVD-2026-68117
GHSA-cjr4-fpcr-5mvq
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Remote, low-complexity, unauthenticated traversal (PR:N/UI:N) gives arbitrary file read and write (C:H/I:H); availability impact is indirect so A:N, and no scope change to another component.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
Cloud Commander before 19.20.2 contains a directory traversal vulnerability in REST file-operation and markdown endpoints that fails to properly validate path normalization. Attackers can use path traversal sequences to read, write, move, or copy files outside the configured root directory.
AnalysisAI
Directory traversal in Cloud Commander (coderaiser/cloudcmd) before 19.20.2 lets remote unauthenticated attackers read, write, move, or copy files outside the configured root directory by supplying path-traversal sequences to REST file-operation and markdown endpoints. The root cause is missing path-normalization enforcement before filesystem operations, giving full arbitrary file read/write on the host filesystem. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires network access to a running Cloud Commander instance (version < 19.20.2) whose REST file-operation endpoints (/api/v1/... … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine high-priority issue rather than an inflated CVSS score. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade to Cloud Commander 19.20.2 or later (https://github.com/coderaiser/cloudcmd/releases/tag/v19.20.2), which adds the root.resolve() boundary check applied by commit b9bdc9ed528350eeb2f9ef974c18998096fae919. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, conduct a complete inventory of systems running Cloud Commander and identify which are internet-accessible or connected to sensitive production networks; simultaneously begin testing Cloud Commander v19.20.2 in a non-production environment. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today