Cloud Commander before 19.20.2 contains a directory traversal vulnerability in REST file-operation and markdown endpoints that fails to properly validate path normalization. Attackers can use path traversal sequences to read, write, move, or copy files outside the configured root directory.

Cloud Commander versions before 19.20.2 contain a directory traversal vulnerability affecting REST file-operation and markdown endpoints. The flaw stems from improper validation of path normalization, allowing attackers to use path traversal sequences to escape the configured root directory. Exploitation can lead to unauthorized reading, writing, moving, or copying of files outside the intended directory scope. The vulnerability is tracked as CVE-2026-82460. A fix was introduced in version 19.20.2, with the patch available in the official GitHub repository. The issue was documented in the project's issue tracker and addressed via a specific commit. Users are advised to upgrade to v19.20.2 or later to mitigate the risk. The vulnerability was also reported by VulnCheck in their advisory.