CVE-2026-110690 in cloudcmd
Summary
by MITRE • 10/15/2026
Cloud Commander (cloudcmd) versions 19.20.2 through 19.21.1 contains a path traversal vulnerability in the GET /api/v1/pack endpoint where the onGET handler at server/rest/index.js:130 calls the unguarded root() function instead of the root.resolve() validation wrapper used elsewhere. Attackers can send percent-encoded directory traversal sequences in the pack request path to read arbitrary files outside the configured --root directory, such as /etc/passwd or SSH private keys, which are archived and streamed back as a downloadable tar.gz file.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/15/2026
Cloud Commander versions 19.20.2 through 19.21.1 contain a critical path traversal vulnerability within the GET /api/v1/pack endpoint that allows unauthenticated attackers to read arbitrary files from the underlying operating system. This flaw stems from an inconsistent implementation of input validation and directory boundary enforcement in the server-side REST API handler located at server/rest/index.js line 130. Specifically, this particular endpoint invokes a root() function directly without applying the necessary path resolution checks that are present in other parts of the application codebase. The absence of these safeguards means that user-supplied input is not properly sanitized or validated against the configured --root directory before being processed by the file system operations.
The technical mechanism of exploitation involves sending percent-encoded directory traversal sequences, such as ../..%2Fetc/passwd, within the request path for the pack endpoint. Because the application fails to resolve and validate these paths against a secure base directory, it interprets the traversal characters literally rather than normalizing them away or rejecting them outright. Consequently, when an attacker requests this malformed path, the server attempts to archive and stream back the specified file as a downloadable tar.gz package. This behavior effectively bypasses the intended isolation boundaries, allowing access to sensitive system files that should remain inaccessible through the web interface.
The operational impact of this vulnerability is severe, particularly in environments where Cloud Commander is exposed to untrusted networks or internet-facing deployments. Attackers can leverage this flaw to exfiltrate critical configuration files such as /etc/passwd and /etc/shadow, which may reveal user accounts and hashed passwords suitable for offline cracking attacks. Furthermore, the ability to read SSH private keys poses a significant risk of unauthorized remote access to servers and infrastructure components protected by key-based authentication. The extraction of these credentials can lead to full system compromise, lateral movement within the network, and potential data breaches depending on the sensitivity of the accessed resources.
This vulnerability is classified under CWE-22: Improper Limitation of a Pathname to a Restricted Directory, which describes scenarios where software does not properly neutralize special elements that could allow paths to traverse outside the intended directory structure. In terms of offensive security frameworks, this exploit aligns with ATT&CK technique T1083: File and Directory Discovery, as it enables an adversary to enumerate and retrieve sensitive files from the host system without direct command-line access. The lack of proper input validation on API endpoints is a common pattern in web applications that rely on implicit trust or inconsistent security controls across different modules.
To mitigate this vulnerability, administrators should immediately upgrade Cloud Commander to version 19.21.2 or later, where the path traversal issue has been addressed by ensuring consistent use of secure path resolution functions across all endpoints. In cases where upgrading is not immediately feasible, deploying a web application firewall with rules specifically designed to detect and block directory traversal patterns in URL paths can provide temporary protection. Additionally, restricting access to Cloud Commander through network segmentation or strong authentication mechanisms reduces the attack surface available to potential adversaries. It is also recommended to audit other API endpoints for similar inconsistencies in input validation logic to prevent analogous vulnerabilities from being exploited elsewhere in the application.