CVE-2026-110690 coderaiser CVE debrief

Who should care

Defenders responsible for Cloud Commander installations, particularly those using versions 19.20.2 through 19.21.1, should assess exposure and apply the vendor patch to prevent path traversal attacks.

Why it matters

The path traversal vulnerability in Cloud Commander versions 19.20.2 through 19.21.1 allows attackers to read arbitrary files outside the configured --root directory, potentially leading to unauthorized access to sensitive information. Defenders should prioritize verifying exposure and applying the vendor patch.

• Potential unauthorized access to sensitive files and directories.
• Possible exposure of confidential data, such as SSH private keys or /etc/passwd.
• Required verification of Cloud Commander version and patch application.
• Potential impact on system integrity and confidentiality.

Technical summary

Cloud Commander versions 19.20.2 through 19.21.1 contain a path traversal vulnerability in the GET /api/v1/pack endpoint. The onGET handler at server/rest/index.js:130 calls the unguarded root() function instead of the root.resolve() validation wrapper used elsewhere. Attackers can send percent-encoded directory traversal sequences in the pack request path to read arbitrary files outside the configured --root directory.

Defensive priority

Defenders should prioritize verifying exposure and applying the vendor patch due to the path traversal vulnerability in Cloud Commander versions 19.20.2 through 19.21.1.

Recommended defensive actions

• Verify exposure by checking if the Cloud Commander version is within the affected range (19.20.2 through 19.21.1).
• Apply the vendor patch (version 19.21.2 or later) to prevent path traversal attacks.
• Monitor for suspicious activity on the /api/v1/pack endpoint.
• Review and update access controls to restrict access to sensitive files and directories.
• Perform a thorough review of system logs to detect potential exploitation attempts.
• Inventory affected systems and prioritize patching based on criticality and exposure.
• Track patch application and verify successful remediation.

Evidence notes

The CVE record and source item provide details on the path traversal vulnerability in Cloud Commander versions 19.20.2 through 19.21.1, with a CVSS score of 8.7 and HIGH severity. Evidence is limited to CVE Program and NVD records, which may not cover all affected deployments or specific exploitation details. Defenders should verify exposure and review system logs for suspicious activity on the /api/v1/pack endpoint.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.