CVE-2026-110231
muCommander through 1.6.2 contains a path traversal vulnerability in UnpackJob that allows attackers to write files outside the destination folder by bypassing its ZipSlip check with unnormalized remote paths.
Does this matter?
Lower severity and a low EPSS score (0.27%). Track it; it rarely justifies an emergency change on its own.
Description
muCommander through 1.6.2 contains a path traversal vulnerability in UnpackJob that allows attackers to write files outside the destination folder by bypassing its ZipSlip check with unnormalized remote paths. Attackers can craft TAR or ZIP entries like ../../.ssh/authorized_keys that, when extracted to FTP or SFTP folders, create or overwrite files writable by the user's remote account.
- CVSS 4.0
- 5.6 MEDIUMCVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
- EPSS
- 0.27% probability · 20th percentile
- Public exploits
- None in Exploit-DB
- CISA KEV
- Not listed
- Weakness
- CWE-22
- Source
- disclosure@vulncheck.com
EPSS moved from 0.2% on 14 October 2026 to 0.3% on 27 October 2026.
References
- https://github.com/mucommander/mucommander/blob/3bc2118e13681a8018b84a06f1c5fea4a3f940f7/mucommander-commons-file/src/main/java/com/mucommander/commons/file/AbstractFile.java#L1021-L1023
- https://github.com/mucommander/mucommander/blob/3bc2118e13681a8018b84a06f1c5fea4a3f940f7/mucommander-core/src/main/java/com/mucommander/job/impl/UnpackJob.java#L233-L256
- https://github.com/mucommander/mucommander/blob/3bc2118e13681a8018b84a06f1c5fea4a3f940f7/mucommander-protocol-sftp/src/main/java/com/mucommander/commons/file/protocol/sftp/SFTPFile.java#L586-L622
- https://github.com/mucommander/mucommander/releases/tag/1.6.2-1
- https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/ryH-CfoiMl
- https://www.vulncheck.com/advisories/mucommander-through-1.6.2-path-traversal-via-archive-extraction-to-ftp-sftp
- https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/ryH-CfoiMl
Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.