CVE Feed

    Dashboard / CVE / CVE-2026-110231

    CVE-2026-110231

    muCommander through 1.6.2 contains a path traversal vulnerability in UnpackJob that allows attackers to write files outside the destination folder by bypassing its ZipSlip check with unnormalized remote paths. Attackers can craft TAR or ZIP entries like ../../.ssh/authorized_keys that, when extracted to FTP or SFTP folders, create or overwrite files writable by the user's remote account.

    Published:Oct 13, 2026
    Last Modified:Oct 14, 2026
    EPS:Oct 13, 2026
    EPSS Score:
    CVSS Score:4.7

    Affected Products

    Vendor
    Mucommander
    Product
    Mucommander

    Exploits

    No exploit reference

    References

    https://github.com/mucommander/mucommander/blob/3bc2118e13681a8018b84a06f1c5fea4a3f940f7/mucommander-commons-file/src/main/java/com/mucommander/commons/file/AbstractFile.java#L1021-L1023
    https://github.com/mucommander/mucommander/blob/3bc2118e13681a8018b84a06f1c5fea4a3f940f7/mucommander-core/src/main/java/com/mucommander/job/impl/UnpackJob.java#L233-L256
    https://github.com/mucommander/mucommander/blob/3bc2118e13681a8018b84a06f1c5fea4a3f940f7/mucommander-protocol-sftp/src/main/java/com/mucommander/commons/file/protocol/sftp/SFTPFile.java#L586-L622
    https://github.com/mucommander/mucommander/releases/tag/1.6.2-1
    https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/ryH-CfoiMl
    https://www.vulncheck.com/advisories/mucommander-through-1.6.2-path-traversal-via-archive-extraction-to-ftp-sftp
    https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/ryH-CfoiMl

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High