CVE-2026-82460CWE-22path-traversal

CVE-2026-82460

Critical · published August 29, 2026

CVSS v3.1
9.8
EPSS
1%
Percentile
59.2
In the wild
Unconfirmed
What it is

Cloud Commander before 19.20.2 contains a directory traversal vulnerability in REST file-operation and markdown endpoints that fails to properly validate path normalization. Attackers can use path traversal sequences to read, write, move, or copy files outside the configured root directory.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
9.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00896 · 59.2th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-08-29T21:17Z
References (7)
https://github.com/coderaiser/cloudcmd · [email protected]https://github.com/coderaiser/cloudcmd/blob/v19.20.1/server/root.js · [email protected]https://github.com/coderaiser/cloudcmd/commit/b9bdc9ed528350eeb2f9ef974c18998096fae919 · [email protected]https://github.com/coderaiser/cloudcmd/issues/474 · [email protected]https://github.com/coderaiser/cloudcmd/releases/tag/v19.20.2 · [email protected]https://www.vulncheck.com/advisories/cloud-commander-before-19.20.2-directory-traversal-via-rest-and-markdown · [email protected]https://github.com/coderaiser/cloudcmd/issues/474 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 30 AUG 16:19Z
    EPSS moved — → 1%
    epss
  • 29 AUG 16:35Z
    Cloud Commander before 19.20.2 Directory Traversal via REST and Markdown
    cvelistv5