CVE-2026-110690: High Path Traversal in Cloud Commander

CVE-2026-110690 is a High severity (CVSS 7.5) path traversal in Cloud Commander versions 19.20.2 through 19.21.1. The GET pack endpoint can read files outside the configured root directory. Upgrade to cloudcmd 19.21.2, which is the fixed release, and restart the service afterward.

What's affected

The record says Cloud Commander (cloudcmd) versions 19.20.2 through 19.21.1 are affected. The project's v19.21.2 release, published on 13 October 2026, is listed with the fix server: pack: path traverse. VulnCheck lists the range as 19.20.2 up to but not including 19.21.2.

The weakness is CWE-23, relative path traversal. Per the record, the onGET handler for the pack endpoint calls an unguarded root function, where other handlers use a wrapper that resolves and checks the path. Percent encoded traversal sequences in the request path can then leave the configured root directory. The record says the files are archived and streamed back as a downloadable tar.gz.

The record gives no authentication requirement. Severity differs by source. The record gives 7.5 (High) and VulnCheck lists 8.7 on a CVSS 4.0 vector. Both are High.

How to check if you're exposed

Find installations of cloudcmd and their versions.

npm ls -g cloudcmd

For containers, check the image tag and the version reported inside. Anything from 19.20.2 through 19.21.1 is in range. Earlier versions are outside the range in the record.

Then check exposure. Cloud Commander is a web file manager, so it is often run on a host with broad file access. If it is reachable from the internet or an untrusted network, anyone could request an archive. Look at the web server or process logs for pack requests with encoded dot sequences. The free in-browser dependency scan at gold.safeguard.sh/scan can match a manifest or lockfile against known CVEs without installing anything.

What to do now

1. Upgrade cloudcmd to 19.21.2 or later and restart the service.
2. Put the file manager behind authentication and a VPN, and do not expose it on a public address.
3. Run it as a dedicated low-privilege user whose own files are limited to what it must serve.
4. If it was exposed, treat anything readable by the service account as possibly copied, and rotate SSH keys and tokens stored there.
5. Check logs for pack requests that look unusual.

Why it matters

A guard that exists but is not called is a very common cause of path traversal. The project already had a helper that resolves a path and checks it stays inside the root. This one handler used the plain function instead, so the check was skipped for it.

Tools that serve files, such as file managers and static servers, depend on that check being applied to every route. Test each new route the same way. Reads of private keys and configuration files are what make this flaw valuable. The record does not mark this CVE as known exploited, and none of the pages we read say it is.

Try it yourself

Click through it at your own pace, or open it full screen.

Quick check

Sources

• cloudcmd v19.21.2 release
• VulnCheck advisory

Last reviewed: 18 October 2026.