{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/cloudcmd-19.20.2---19.21.1/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:cloudcmd:cloudcmd:19.20.2:*:*:*:*:*:*:*","cpe:2.3:a:cloudcmd:cloudcmd:19.21.1:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-110690"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["cloudcmd (19.20.2 - 19.21.1)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Cloud Commander"],"content_html":"\u003cp\u003eCloud Commander (cloudcmd) versions 19.20.2 through 19.21.1 contain a path traversal vulnerability in the GET /api/v1/pack endpoint. The flaw exists because the onGET handler at server/rest/index.js improperly calls an unguarded root() function rather than the secure root.resolve() validation wrapper used elsewhere in the application. An unauthenticated attacker can exploit this by sending percent-encoded directory traversal sequences within the pack request path. When processed, the application accesses files outside the intended root directory, archives them into a .tar.gz file, and streams the archive back to the requester. This allows attackers to exfiltrate sensitive host files such as /etc/passwd or SSH private keys. Given the ease of exploitation, organizations running affected versions of Cloud Commander should restrict access to the application or upgrade to a patched version immediately.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an unauthenticated remote attacker to read arbitrary files from the underlying host filesystem. This leads to the exposure of sensitive configuration files, system credentials, and SSH private keys, potentially resulting in full system compromise or lateral movement. The vulnerability impacts any environment utilizing these versions of Cloud Commander for remote file management.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Cloud Commander to a version outside of the 19.20.2 through 19.21.1 range immediately.\u003c/li\u003e\n\u003cli\u003eImplement strict ingress filtering for the Cloud Commander API endpoints, specifically denying requests to /api/v1/pack containing traversal characters (e.g., ../).\u003c/li\u003e\n\u003cli\u003eEnable web server access logs to audit all requests to /api/v1/pack and identify anomalous paths containing directory traversal patterns.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-14T16:36:00Z","date_published":"2026-10-14T16:36:00Z","id":"https://feed.craftedsignal.io/briefs/2026-10-cloud-commander-traversal/","summary":"Cloud Commander versions 19.20.2 through 19.21.1 are vulnerable to a path traversal flaw in the GET /api/v1/pack endpoint allowing unauthenticated file exfiltration.","title":"Path Traversal Vulnerability in Cloud Commander","url":"https://feed.craftedsignal.io/briefs/2026-10-cloud-commander-traversal/"}],"language":"en","title":"CraftedSignal Threat Feed - Cloudcmd (19.20.2 - 19.21.1)","version":"https://jsonfeed.org/version/1.1"}