CVE-2026-110231
mediummuCommander through 1.6.2 contains a path traversal vulnerability in UnpackJob that allows attackers to write files outside the destination folder by bypassing…
muCommander through 1.6.2 contains a path traversal vulnerability in UnpackJob that allows attackers to write files outside the destination folder by bypassing its ZipSlip check with unnormalized remote paths. Attackers can craft TAR or ZIP entries like ../../.ssh/authorized_keys that, when extracted to FTP or SFTP folders, create or overwrite files writable by the user's remote account.
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://github.com/mucommander/mucommander/blob/3bc2118e13681a8018b84a06f1c5fea4a3f940f7/m... disclosure@vulncheck.com
- https://github.com/mucommander/mucommander/blob/3bc2118e13681a8018b84a06f1c5fea4a3f940f7/m... disclosure@vulncheck.com
- https://github.com/mucommander/mucommander/blob/3bc2118e13681a8018b84a06f1c5fea4a3f940f7/m... disclosure@vulncheck.com
- https://github.com/mucommander/mucommander/releases/tag/1.6.2-1 disclosure@vulncheck.com
- https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/ryH-CfoiMl disclosure@vulncheck.com
- https://www.vulncheck.com/advisories/mucommander-through-1.6.2-path-traversal-via-archive-... disclosure@vulncheck.com
- https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/ryH-CfoiMl 134c704f-9b21-4f2e-91b3-4a467353bcc0