CVE-2026-82460

Cloud Commander, a web-based file manager, fails to properly normalize and validate file paths in its REST file-operation and markdown endpoints in versions prior to 19.20.2, resulting in a directory traversal flaw (CWE-22). An unauthenticated network attacker can send path traversal sequences in requests to these endpoints to escape the configured root directory. Successful exploitation allows the attacker to read, write, move, or copy files outside the root with the privileges of the server process. Any deployment running an affected version is exposed, with the greatest risk to instances reachable from untrusted networks. No active exploitation is currently known: the flaw is not in CISA KEV, no public proof-of-concept exists, and EPSS estimates roughly a 0.8% chance of exploitation within 30 days.

What to do: Upgrade to Cloud Commander 19.20.2 or later. Until patched, restrict network access to the REST API (bind to trusted interfaces or place behind an authenticating reverse proxy that rejects traversal sequences) and review access logs for requests to the file-operation and markdown endpoints containing '../' sequences. Also check directories outside the configured root for unexpected file writes, moves, or copies.