Description
Cloud Commander before 19.20.2 contains a directory traversal vulnerability in REST file-operation and markdown endpoints that fails to properly validate path normalization. Attackers can use path traversal sequences to read, write, move, or copy files outside the configured root directory.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
coderaiser cloudcmd
Default version status: unaffected
0 to < 19.20.2affected
pkg:npm/cloudcmdReferences
- https://github.com/coderaiser/cloudcmd/issues/474 ↗
- https://github.com/coderaiser/cloudcmd/commit/b9bdc9ed528350eeb2f9ef974c18998096fae919 ↗
- https://github.com/coderaiser/cloudcmd/releases/tag/v19.20.2 ↗
- https://github.com/coderaiser/cloudcmd/blob/v19.20.1/server/root.js ↗
- https://github.com/coderaiser/cloudcmd ↗
- https://www.vulncheck.com/advisories/cloud-commander-before-19.20.2-directory-traversal-via-rest-and-markdown ↗