CVE-2026-82460
CriticalCVSS 9.8Summary
Cloud Commander before version 19.20.2 contains a directory traversal vulnerability in REST file-operation and markdown endpoints that fails to properly validate path normalization. Attackers can use path traversal sequences to read, write, move, or copy files outside the configured root directory.
Risk Assessment
The vulnerability allows unauthorized access to files outside the root directory, potentially leading to leakage of sensitive data or modification. This can compromise system integrity and information confidentiality.
Recommendation
Update Cloud Commander to version 19.20.2 or later that includes a fix. Restrict access to the application to trusted users and networks only.
Original NVD description (English source)
Cloud Commander before 19.20.2 contains a directory traversal vulnerability in REST file-operation and markdown endpoints that fails to properly validate path normalization. Attackers can use path traversal sequences to read, write, move, or copy files outside the configured root directory.