CVE-2026-82460
Cloud Commander before 19.20.2 contains a directory traversal vulnerability in REST file-operation and markdown endpoints that fails to properly validate path normalization. Attackers can use path traversal sequences to read, write, move, or copy files outside the configured root directory.
Scoring
- Severity
- CRITICAL
- CVSS base score
- 9.8
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- EPSS probability
- 0.77%
- CWE
- CWE-22
- Published
- 2026-08-29
- Last modified
- 2026-08-31
Affected products
- coderaiser cloudcmd
Weakness type
Related vulnerabilities
- CVE-2026-85706 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab
- CVE-2026-78657 — SigmaForms Pro <= 1.4.11 - Unauthenticated Arbitrary File Deletion via Path Traversal in File Upload Field
- CVE-2026-61560 — @zereight/mcp-gitlab's unauthenticated arbitrary file read via `upload_markdown` enables PAT exfiltration and full account takeover
- CVE-2026-82100 — DataStage on Cloud Pak for Data has several vulnerabilities due to open source software
- CVE-2026-82954 — Dokploy Settings application.ts writeTraefikConfigInPath path traversal
- CVE-2026-85661 — excel-mcp-server 0.1.8 Arbitrary File Read/Write via stdio mode
- CVE-2026-89040 — Tencent Mass Service Engine in Cluster (MSEC) path traversal
- CVE-2026-88069 — Path traversal in Pandora archive extractor allows arbitrary file writes outside the extraction directory in pandora analysis