{"id":"CVE-2026-82460","summary":"Cloud Commander before 19.20.2 Directory Traversal via REST and Markdown","details":"Cloud Commander before 19.20.2 contains a directory traversal vulnerability in REST file-operation and markdown endpoints that fails to properly validate path normalization. Attackers can use path traversal sequences to read, write, move, or copy files outside the configured root directory.","modified":"2026-09-02T03:30:29.704482349Z","published":"2026-08-29T16:35:24.787Z","database_specific":{"cwe_ids":["CWE-22"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/82xxx/CVE-2026-82460.json","cna_assigner":"VulnCheck"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/82xxx/CVE-2026-82460.json"},{"type":"ADVISORY","url":"https://github.com/coderaiser/cloudcmd/releases/tag/v19.20.2"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-82460"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/cloud-commander-before-19.20.2-directory-traversal-via-rest-and-markdown"},{"type":"REPORT","url":"https://github.com/coderaiser/cloudcmd/issues/474"},{"type":"FIX","url":"https://github.com/coderaiser/cloudcmd/commit/b9bdc9ed528350eeb2f9ef974c18998096fae919"},{"type":"PACKAGE","url":"https://github.com/coderaiser/cloudcmd"},{"type":"ARTICLE","url":"https://github.com/coderaiser/cloudcmd/blob/v19.20.1/server/root.js"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/coderaiser/cloudcmd","events":[{"introduced":"0"},{"fixed":"0ed9f81109661ec9313492ce20271289bd59063e"},{"fixed":"b9bdc9ed528350eeb2f9ef974c18998096fae919"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"19.20.2"}],"source":["DESCRIPTION","REFERENCES"]}}],"versions":["v19.20.1","v19.20.0","v19.19.1","v19.19.0","v19.18.1","v19.18.0","v19.17.0","v19.16.0","v19.13.1","v19.13.0","v19.12.5","v19.12.4","v19.12.3","v19.12.2","v19.12.1","v19.12.0","v19.11.14","v19.11.13","v19.11.12","v19.11.11","v19.11.10","v19.11.9","v19.11.8","v19.11.7","v19.11.6","v19.11.5","v19.11.3","v19.11.2","v19.11.1","v19.11.0","v19.10.2","v19.10.1","v19.10.0","19.9.23","v19.9.22","v19.9.21","v19.9.20","v19.9.19","v19.9.18","v19.9.17","v19.9.16","v19.9.15","v19.9.14","v19.9.13","v19.9.11","v19.9.9","v19.9.8","v19.9.7","v19.9.6","v19.9.5","v19.9.4","v19.9.3","v19.9.2","v19.9.1","v19.9.0","v19.8.15","v19.8.14","v19.8.13","v19.8.12","v19.8.11","v19.8.10","v19.8.9","v19.8.8","v19.8.7","v19.8.6","v19.8.5","v19.8.4","v19.8.3","v19.8.2","v19.8.1","v19.8.0","v19.7.1","v19.7.0","v19.6.9","v19.6.8","v19.6.7","v19.6.6","v19.6.5","v19.6.4","v19.6.2","v19.6.1","v19.6.0","v19.5.1","v19.5.0","v19.4.1","v19.4.0","v19.3.9","v19.3.8","v19.3.7","v19.3.6","v19.3.5","v19.3.4","v19.3.3","v19.3.2","v19.3.0","v19.2.0","v19.1.21","v19.1.20","v19.1.19","v19.1.18","v19.1.17","v19.1.16","v19.1.15","v19.1.14","v19.1.13","v19.1.12","v19.1.11","v19.1.10","v19.1.9","v19.1.8","v19.1.7","v19.1.6","v19.1.5","v19.1.4","v19.1.3","v19.1.2","v19.1.1","v19.1.0","v19.0.17","v19.0.16","v19.0.15","v19.0.14","v19.0.13","v19.0.12","v19.0.11","v19.0.10","v19.0.9","v19.0.8","v19.0.7","v19.0.6","v19.0.5","v19.0.4","v19.0.3","v19.0.2","v19.0.1","v19.0.0","v18.8.11","v18.8.10","v18.8.9","v18.8.8","v18.8.7","v18.8.6","v18.8.5","v18.8.4","v18.8.3","v18.8.2","v18.8.1","v18.8.0","v18.7.4","v18.7.3","v18.7.2","v18.7.1","v18.7.0","v18.6.1","v18.6.0","v18.5.2","v18.5.1","v18.5.0","v18.4.1","v18.4.0","v18.3.0","v18.2.1","v18.2.0","v18.1.0","v18.0.2","v18.0.1","v18.0.0","v17.4.4","v17.4.3","v17.4.2","v17.4.1","v17.4.0","v17.3.3","v17.3.2","v17.3.1","v17.3.0","v17.2.1","v17.2.0","v17.1.6","v17.1.5","v17.1.4","v17.1.3","v17.1.2","v17.1.1","v17.1.0","v17.0.7","v17.0.6","v17.0.5","v17.0.3","v17.0.2","v17.0.1","v17.0.0","v16.18.0","v16.17.9","v16.17.8","v16.17.7","v16.17.6","v16.17.5","v16.17.4","v16.17.3","v16.17.2","v16.17.1","v16.17.0","v16.16.3","v16.16.2","v16.16.1","v16.16.0","v16.15.0","v16.14.1","v16.14.0","v16.13.1","v16.13.0","v16.12.0","v16.11.0","v16.9.0","v16.8.0","v16.7.0","v16.6.1","v16.6.0","v16.5.0","v16.4.1","v16.4.0","v16.3.1","v16.3.0","v16.2.0","16.1.1","v16.1.1","v16.1.0","v16.0.1","v16.0.0","v15.9.15","v15.9.14","v15.9.13","v15.9.12","v15.9.11","v15.9.10","v15.9.9","v15.9.8","v15.9.7","v15.9.6","v15.9.5","v15.9.4","v15.9.3","v15.9.2","v15.9.1","v15.9.0","v15.8.1","v15.8.0","v15.7.1","v15.7.0","v15.6.0","v15.5.2","v15.5.1","v15.5.0","v15.4.4","v15.4.3","v15.4.2","v15.4.1","v15.4.0","v15.3.4","v15.3.1","v15.3.0","v15.2.0","v15.1.0","v15.0.4","v15.0.3","v15.0.2","v15.0.1","v15.0.0","v14.9.3","v14.9.2","v14.9.1","v14.9.0","v14.8.0","v14.7.2","v14.7.1","v14.7.0","v14.6.0","v14.5.1","v14.5.0","v14.4.0","v14.3.10","v14.3.9","v14.3.8","v14.3.7","v14.3.6","v14.3.5","v14.3.3","v14.3.2","v14.3.1","v14.3.0","v14.2.1","v14.2.0","v14.1.2","v14.1.1","v14.1.0","v14.0.2","v14.0.1","v14.0.0","v13.4.2","v13.4.1","v13.4.0","v13.3.0","v13.2.1","v13.2.0","v13.1.0","v13.0.1","v13.0.0","v12.6.3","v12.6.2","v12.6.1","v12.6.0","v12.5.0","v12.4.0","v12.3.2","v12.3.1","v12.3.0","v12.2.0","v12.1.0","v12.0.2","v12.0.1","v12.0.0","v11.8.6","v11.8.5","v11.8.4","v11.8.3","v11.8.2","v11.8.1","v11.8.0","v11.7.1","v11.7.0","v11.6.0","v11.5.4","v11.5.3","v11.5.2","v11.5.1","v11.5.0","v11.4.1","v11.4.0","v11.3.1","v11.3.0","v11.2.3","v11.2.2","v11.2.1","v11.2.0","v11.1.0","v11.0.0","v10.8.2","v10.8.1","v10.8.0","v10.7.0","v10.5.3","v10.5.2","v10.5.1","v10.5.0","v10.4.1","v10.4.0","v10.3.2","v10.3.1","v10.3.0","v10.2.3","v10.2.2","v10.2.1","v10.2.0","v10.1.2","v10.1.1","v10.1.0","v10.0.3","v10.0.2","v10.0.1","v10.0.0","v9.6.0","v9.5.0","v9.4.0","v9.3.2","v9.3.1","v9.3.0","v9.2.0","v9.1.6","v9.1.5","v9.1.4","v9.1.3","v9.1.2","v9.1.1","v9.1.0","v9.0.0","v8.5.2","v8.5.1","v8.5.0","v8.4.1","v8.4.0","v8.3.0","v8.2.2","v8.2.1","v8.2.0","v8.1.3","v8.1.2","v8.1.1","v8.0.5","v8.0.4","v8.0.3","v8.0.2","v8.0.1","v8.0.0","v7.9.0","v7.8.0","v7.7.3","v7.7.2","v7.7.1","v7.7.0","v7.6.0","v7.5.2","v7.5.1","v7.5.0","v7.3.2","v7.3.1","v7.3.0","v7.2.2","v7.2.1","v7.2.0","v7.1.1","v7.1.0","v7.0.2","v6.15.4","v6.15.3","v6.15.2","v6.15.1","v6.15.0","v6.14.4","v6.14.3","v6.14.2","v6.14.1","v6.14.0","v6.13.0","v6.12.0","v6.11.0","v6.10.1","v6.10.0","v6.9.3","v6.9.2","v6.9.1","v6.9.0","v6.8.1","v6.8.0","v6.7.0","v6.6.3","v6.6.2","v6.6.1","v6.6.0","v6.5.6","v6.5.5","v6.5.4","v6.5.3","v6.5.2","v6.5.1","v6.5.0","v6.4.0","v6.3.1","v6.3.0","v6.2.2","v6.2.1","v6.2.0","v6.1.0","v6.0.3","v6.0.2","v6.0.1","v6.0.0","v5.13.0","v5.12.4","v5.12.3","v5.12.2","v5.12.1","v5.12.0","v5.11.1","v5.11.0","v5.10.2","v5.10.1","v5.10.0","v5.9.1","v5.9.0","v5.8.0","v5.7.6","v5.7.5","v5.7.4","v5.7.3","v5.7.2","v5.7.1","v5.7.0","v5.6.2","v5.6.1","v5.6.0","v5.5.1","v5.5.0","v5.4.3","v5.4.2","v5.4.1","v5.4.0","v5.3.2","v5.3.1","v5.3.0","v5.2.3","v5.2.2","v5.2.1","v5.2.0","v5.1.5","v5.1.4","v5.1.3","v5.1.2","v5.1.1","v5.1.0","v5.0.15","v5.0.14","v5.0.13","v5.0.12","v5.0.11","v5.0.10","v5.0.9","v5.0.8","v5.0.7","v5.0.6","v5.0.5","v5.0.4","v5.0.3","v5.0.2","v5.0.1","v5.0.0","v4.7.7","v4.7.6","v4.7.5","v4.7.4","v4.7.3","v4.7.2","v4.7.1","v4.7.0","v4.6.0","v4.5.7","v4.5.6","v4.5.5","v4.5.4","v4.5.3","v4.5.2","v4.5.1","v4.5.0","v4.4.0","v4.3.5","v4.3.4","v4.3.3","v4.3.2","v4.3.1","v4.3.0","v4.2.0","v4.1.2","v4.1.1","v4.1.0","v4.0.0","v3.8.1","v3.8.0","v3.7.2","v3.7.1","v3.7.0","v3.6.0","v3.5.0","v3.4.0","v3.3.0","v3.2.0","v3.1.4","v3.1.3","v3.1.2","v3.1.1","v3.1.0","v3.0.4","v3.0.3","v3.0.2","v3.0.1","v3.0.0","v2.9.3","v2.9.2","v2.9.1","v2.9.0","v2.8.0","v2.7.1","v2.7.0","v2.6.0","v2.5.1","v2.5.0","v2.4.2","v2.4.1","v2.4.0","v2.3.1","v2.3.0","v2.2.1","v2.2.0","v2.1.0","v2.0.0","v1.5.0","v1.4.1","v1.4.0","v1.3.2","v1.3.1","v1.3.0","v1.2.0","v1.1.1","v1.1.0","v1.0.0","v0.9.2","v0.9.1","v0.9.0","v0.8.4","v0.8.3","v0.8.2","v0.8.1","v0.8.0","v0.7.0","v0.6.0","v0.5.0","v0.4.0","v0.3.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-82460.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}]}