CVEvulnerability
CVE-2026-110231
5.6 MEDIUM
Official page ↗
- Status
- Awaiting Analysis
- Published
- 2026-10-13
- Last modified
- 2026-10-26
- Assigner
- [email protected]
- CVSS 4.0 ([email protected])
- 5.6 MEDIUM — CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- CVSS 3.1 ([email protected])
- 4.7 MEDIUM — CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N
- Weaknesses
- CWE-22
Description
muCommander through 1.6.2 contains a path traversal vulnerability in UnpackJob that allows attackers to write files outside the destination folder by bypassing its ZipSlip check with unnormalized remote paths. Attackers can craft TAR or ZIP entries like ../../.ssh/authorized_keys that, when extracted to FTP or SFTP folders, create or overwrite files writable by the user's remote account.
Related
Weakness · CWE (1)
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness
References
- https://github.com/mucommander/mucommander/blob/3bc2118e13681a8018b84a06f1c5fea4a3f940f7/mucommander-commons-file/src/main/java/com/mucommander/commons/file/AbstractFile.java#L1021-L1023 github.com
- https://github.com/mucommander/mucommander/blob/3bc2118e13681a8018b84a06f1c5fea4a3f940f7/mucommander-core/src/main/java/com/mucommander/job/impl/UnpackJob.java#L233-L256 github.com
- https://github.com/mucommander/mucommander/blob/3bc2118e13681a8018b84a06f1c5fea4a3f940f7/mucommander-protocol-sftp/src/main/java/com/mucommander/commons/file/protocol/sftp/SFTPFile.java#L586-L622 github.com
- https://github.com/mucommander/mucommander/releases/tag/1.6.2-1 github.com
- https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/ryH-CfoiMl hackmd.io
- https://www.vulncheck.com/advisories/mucommander-through-1.6.2-path-traversal-via-archive-extraction-to-ftp-sftp www.vulncheck.com
- https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/ryH-CfoiMl hackmd.io