---
id: CVE-2026-110232
title: >-
  Fossify File Manager through 1.6.2 contains a path traversal vulnerability
  that allows crafted ZIP archives to write files outside the extraction folder
  by bypassing an unanchored startsWith check
summary: >-
  Fossify File Manager through 1.6.2 contains a path traversal vulnerability
  that allows crafted ZIP archives to write files outside the extraction folder
  by bypassing an unanchored startsWith check. Attackers can supply archive
  entries li…
severity: low
cvss: 3.3
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N'
cwe:
  - CWE-22
published: '2026-10-13'
updated: '2026-10-13'
sourceUpdated: '2026-10-13T19:30:29.797'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-110232'
references:
  - url: >-
      https://github.com/FossifyOrg/File-Manager/blob/82b3c98c9a7b90d8af2c2ff0c39c87f5917e1b08/app/src/main/kotlin/org/fossify/filemanager/activities/DecompressActivity.kt#L161-L189
    label: disclosure@vulncheck.com
  - url: 'https://github.com/FossifyOrg/File-Manager/releases/tag/1.6.2'
    label: disclosure@vulncheck.com
  - url: 'https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/Hk2woGjsze'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/fossify-file-manager-through-1.6.2-zip-slip-path-traversal-via-decompressactivity
    label: disclosure@vulncheck.com
tags:
  - nvd
ingestedAt: '2026-10-13T19:43:28.942Z'
---

## Overview

Fossify File Manager through 1.6.2 contains a path traversal vulnerability that allows crafted ZIP archives to write files outside the extraction folder by bypassing an unanchored startsWith check. Attackers can supply archive entries like ../<name>_x/file to create or overwrite files in sibling folders when a user extracts the archive.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.