Cloud Commander EUVD-2026-101027

Exploitation targets the GET /api/v1/pack endpoint whose onGET handler (server/rest/index.js:130) calls the unguarded root() function rather than the root.resolve() validation wrapper used on other endpoints, so no special configuration beyond a running Cloud Commander instance with its default REST API enabled is required; the attacker simply supplies percent-encoded traversal sequences in the pack request path. Limiting factors: the attacker needs network reachability to the cloudcmd HTTP service (many deployments bind to localhost or sit behind a reverse proxy), and if the operator has enabled Cloud Commander's optional authentication, that would gate access even though the CVSS vector assumes PR:N. Impact is confined to reading files the server process can access outside --root; there is no write or code-execution primitive.

All signals point to a genuine, readily exploitable confidentiality breach, though real-world priority is tempered by the product's limited footprint. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N, 8.7 High) describes a fully remote, unauthenticated, low-complexity attack with no user interaction that yields high confidentiality impact but no integrity or availability impact - consistent with arbitrary file read via path traversal (CWE-23). A publicly available exploit code exists (a proof-of-concept gist is referenced), which raises practical exploitability, but this CVE is NOT in CISA KEV and no EPSS score was provided, so there is no evidence of active or widespread exploitation at time of analysis. The combination of trivial exploitation (percent-encoded traversal in a single GET request) plus a public POC makes opportunistic scanning plausible, yet the absence of KEV/EPSS signals and the niche nature of Cloud Commander suggest this is a real but moderate priority rather than an emergency. Note the vendor confirms a fix (v19.21.2) and the root cause is precisely documented (onGET calls unguarded root() instead of root.resolve()), so remediation is clear-cut.

A remote attacker locates an internet-reachable Cloud Commander instance (versions 19.20.2-19.21.1) and sends a GET /api/v1/pack request containing percent-encoded directory traversal sequences in the path. Because the onGET handler calls the unguarded root() function, the server archives files outside the configured --root directory and streams them back as a tar.gz, letting the attacker exfiltrate /etc/passwd, SSH private keys, or application secrets. A public proof-of-concept gist demonstrating this exists, lowering the barrier to exploitation.