{"id":"CVE-2026-110232","title":"Fossify File Manager through 1.6.2 contains a path traversal vulnerability that allows crafted ZIP archives to write files outside the extraction folder by bypassing an unanchored startsWith check","summary":"Fossify File Manager through 1.6.2 contains a path traversal vulnerability that allows crafted ZIP archives to write files outside the extraction folder by bypassing an unanchored startsWith check. Attackers can supply archive entries li…","severity":"low","cvss":3.3,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","cwe":["CWE-22"],"published":"2026-10-13","updated":"2026-10-13","sourceUpdated":"2026-10-13T19:30:29.797","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110232","references":[{"url":"https://github.com/FossifyOrg/File-Manager/blob/82b3c98c9a7b90d8af2c2ff0c39c87f5917e1b08/app/src/main/kotlin/org/fossify/filemanager/activities/DecompressActivity.kt#L161-L189","label":"disclosure@vulncheck.com"},{"url":"https://github.com/FossifyOrg/File-Manager/releases/tag/1.6.2","label":"disclosure@vulncheck.com"},{"url":"https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/Hk2woGjsze","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/fossify-file-manager-through-1.6.2-zip-slip-path-traversal-via-decompressactivity","label":"disclosure@vulncheck.com"}],"tags":["nvd"],"ingestedAt":"2026-10-13T19:43:28.942Z","slug":"CVE-2026-110232","body":"## Overview\n\nFossify File Manager through 1.6.2 contains a path traversal vulnerability that allows crafted ZIP archives to write files outside the extraction folder by bypassing an unanchored startsWith check. Attackers can supply archive entries like ../<name>_x/file to create or overwrite files in sibling folders when a user extracts the archive.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":18,"depthScoreParts":{"impact":18.2,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}