CVE-2026-110690: cloudcmd 19.20.2 to before 19.21.2

Affected technology

cloudcmd · 19.20.2 to before 19.21.2
coderaiser

Description’s affected range: versions 19.20.2 through 19.21.1

Component: Not specified by the source
Function: instead

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · No privileges required · No user interaction required

What an attacker can do

Attackers can send percent-encoded directory traversal sequences in the pack request path to read arbitrary files outside the configured --root directory, such as /etc/passwd or SSH private keys, which are archived and streamed back as a downloadable tar.gz file. Vendor/CNA’s CVSS 4.0 assessment (base score 8.7/10) rates confidentiality impact as high; integrity and availability impact as none.