CVE-2026-110690 Details

A path traversal vulnerability has been identified in Cloud Commander (cloudcmd) versions 19.20.2 prior to 19.21.2. The issue resides in the GET /api/v1/pack endpoint, where the onGET handler calls the unguarded root() function instead of the root.resolve() validation wrapper used in other parts of the application. This flaw allows attackers to send percent-encoded directory traversal sequences in the pack request path, enabling them to read arbitrary files outside the designated --root directory. Sensitive files such as /etc/passwd or SSH private keys can be accessed, with the retrieved data archived and sent back to the user as a downloadable tar.gz file.

Users can upgrade to Cloud Commander version 19.21.2 or later, where this vulnerability has been fixed.