Cloud Commander (cloudcmd) versions 19.20.2 through 19.21.1 contain a path traversal flaw in the GET /api/v1/pack endpoint. The onGET handler mistakenly calls the unguarded root() function instead of the validated root.resolve() wrapper, permitting an attacker to craft percent‑encoded directory traversal sequences. When processed, the server packages the requested files into a tar.gz archive and streams the archive back to the client, effectively leaking arbitrary files such as /etc/passwd or SSH private keys.

The affected product is Cloud Commander (cloudcmd) from coderaiser, releases 19.20.2 through 19.21.1. No other versions are listed as vulnerable. Users operating these versions should verify whether the GET /api/v1/pack endpoint is exposed in their deployment and assess the directories served by the –root option.

The CVSS score of 8.7 indicates a high‑severity vulnerability, while the EPSS score of less than 1% shows a low but non‑zero exploitation probability. The vulnerability is not yet listed in the CISA KEV catalog, suggesting limited widespread exploitation. Because the flaw is triggered via an unauthenticated HTTP GET request, any remote actor able to reach the service can construct a malicious request and receive a downloadable tar.gz archive containing arbitrary system files.