{"id":"CVE-2026-110232","title":"Fossify File Manager through 1.6.2 contains a path traversal vulnerability that allows crafted ZIP archives to write files outside the extraction folder by bypassing an unanchored startsWith check","summary":"Fossify File Manager through 1.6.2 contains a path traversal vulnerability that allows crafted ZIP archives to write files outside the extraction folder by bypassing an unanchored startsWith check. Attackers can supply archive entries li…","severity":"low","cvss":3.3,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","cwe":["CWE-22"],"vendor":"Fossify","product":"Fossify File Manager","affected":["file_manager <= 1.6.2"],"published":"2026-10-13","updated":"2026-10-17","sourceUpdated":"2026-10-17T02:17:18.207","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110232","references":[{"url":"https://github.com/FossifyOrg/File-Manager/blob/82b3c98c9a7b90d8af2c2ff0c39c87f5917e1b08/app/src/main/kotlin/org/fossify/filemanager/activities/DecompressActivity.kt#L161-L189","label":"disclosure@vulncheck.com"},{"url":"https://github.com/FossifyOrg/File-Manager/releases/tag/1.6.2","label":"disclosure@vulncheck.com"},{"url":"https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/Hk2woGjsze","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/fossify-file-manager-through-1.6.2-zip-slip-path-traversal-via-decompressactivity","label":"disclosure@vulncheck.com"}],"tags":["nvd","cve.org"],"epss":0.00205,"epssPercentile":0.10438,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-17T00:37:53.014210Z"},"ingestedAt":"2026-10-13T19:43:28.942Z","slug":"CVE-2026-110232","body":"## Overview\n\nFossify File Manager through 1.6.2 contains a path traversal vulnerability that allows crafted ZIP archives to write files outside the extraction folder by bypassing an unanchored startsWith check. Attackers can supply archive entries like ../<name>_x/file to create or overwrite files in sibling folders when a user extracts the archive.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":18,"depthScoreParts":{"impact":18.2,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}