Cloud Commander Path Traversal CVE-2026-82460: Arbitrary File Read/Write Leads to RCE

Cloud Commander 19.20.2 on 29 August patches CVE-2026-82460 (CVSS 3.1 9.8 / CVSS 4.0 9.3, CWE-22 path traversal). REST file-ops and Markdown render endpoints lack path-normalization checks. Unauthenticated attackers use `../` sequences to read, write, move, or copy files outside the sandbox root, then overwrite SSH authorized_keys or app configs for remote command execution.

Incident Overview

On 29 August 2026, Coderaiser released Cloud Commander 19.20.2, patching CVE-2026-82460 path traversal disclosed by a VulnCheck researcher. Cloud Commander is a self-hosted Node.js web file manager used by individual developers, ops, and small teams to browse and edit server files from a browser, with a built-in console. The bug sits in path normalization on REST file-ops endpoints (rename/move/copy/pack/extract) and the Markdown render endpoint. An unauthenticated attacker only needs the exposed HTTP/HTTPS port. Official and third-party databases rate it Critical. CVSS 3.1 9.8 (CWE-22), CVSS 4.0 9.3. Attack vector network, low complexity, no privileges, no user interaction.

Technical Details

Cloud Commander normalizes user-supplied paths via an internal root() function. The function does not verify the normalized path still sits inside the --root configured root. Only the GET listing endpoint extra-checked indexOf(config('root')) !== 0. REST ops and Markdown render did not. Attack surface:

• REST file ops: craft paths with ../ or URL-encoded %2e%2e%2f to run rename/move/copy/pack/extract out of sandbox. Write or replace files in any writable directory;
• Markdown render: same path via ?relative= reads any readable file;
• Typical weaponization: overwrite ~/.ssh/authorized_keys with attacker pubkey for passwordless SSH, overwrite web-app configs (PHP/Node.js entrypoints) or crontab for RCE;
• PostgreSQL/MongoDB config files are common targets. Change listen address or admin password, restart the service, take full control;
• Fix gap: older versions added indexOf(config('root')) !== 0 on GET listing only. Never applied the same check to REST/Markdown. Surface-level root check, no underlying validation.

CVE vector: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H and CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. Network-reachable, no auth, no downstream-system impact required, full C/I/A against the component.

Impact

• Affected versions: all Cloud Commander versions earlier than 19.20.2 (npm package cloudcmd);
• Exploit bar: default config with auth off and --root sandbox only needs no credentials. Auth on but sandbox trusted still crosses the same REST/Markdown endpoints;
• Exposure: inventory self-hosted nodes with npm list cloudcmd. Many ops expose Cloud Commander on intranet, behind a reverse proxy, or on a public port;
• Related input: path assembly must use ../, URL-encoded %2e%2e%2f, or double-encoding to punch through;
• Related tradecraft matches other recently exposed web file managers (CVE-2026-63569, Gitea diffpatch CVE-2026-60004, Apache Camel CXF CVE-2026-47323). All use path or deserialization as the initial foothold.

Remediation

• Upgrade now:

npm install cloudcmd@latest

Cloud Commander must be 19.20.2 or later. npm list cloudcmd version must be ≥ 19.20.2;

• Map exposure:

grep -n 'cloudcmd' /etc/nginx/conf.d/*.conf

(or the matching reverse-proxy config). If public access is required, pin --root to a dedicated sandbox directory and source-IP-whitelist the entire proxy;

• Harden auth: enable Cloud Commander built-in account auth (do not rely on --root sandbox alone). Add OTP/TOTP. Do not trust filesystem isolation only;
• WAF fallback: block ../, %2e%2e%2f, and UTF-8 encoding combos at reverse proxy or WAF. Log the source and temp-ban the account;
• Incident review: check ~/.ssh/authorized_keys, /etc/crontab, /etc/cron.d/*, and web-app entry files for unexpected changes. Disable accounts with injected SSH keys immediately. Wipe planted cron scripts immediately;
• Network: put Cloud Commander behind VPN/jump host. Do not face the internet. Intranet exposure still belongs on the ops management segment only;
• Node inventory:

ps -ef | grep cloudcmd
systemctl list-unit-files | grep cloudcmd

Enumerate Docker/K8s deploy lists. Do not miss long-tail instances.

References

• NVD: CVE-2026-82460
• Cloud Commander v19.20.2 Release Notes
• Fix commit b9bdc9e
• VulnCheck Advisory
• Path Traversal report Issue #474