{"id":"CVE-2026-110231","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-110231","generatedAt":"2026-10-28T10:36:26.683Z","title":"muCommander through 1.6.2 contains a path traversal vulnerability in UnpackJob that allows attackers to write files outside the destination folder by bypassing its ZipSlip check with unnormalized remote paths.","description":"muCommander through 1.6.2 contains a path traversal vulnerability in UnpackJob that allows attackers to write files outside the destination folder by bypassing its ZipSlip check with unnormalized remote paths. Attackers can craft TAR or ZIP entries like ../../.ssh/authorized_keys that, when extracted to FTP or SFTP folders, create or overwrite files writable by the user's remote account.","published":"2026-10-13T19:18:48.000Z","lastModified":"2026-10-26T19:16:30.000Z","status":"Awaiting Analysis","sourceIdentifier":"disclosure@vulncheck.com","cvss":{"version":"4.0","score":5.6,"severity":"MEDIUM","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M"},"cwe":["CWE-22"],"affected":[],"epss":{"score":0.00275,"percentile":0.19822,"date":"2026-10-27","history":[{"date":"2026-10-14","score":0.00201,"percentile":0.0932}]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (0.27%). Track it; it rarely justifies an emergency change on its own."},"changes":[{"kind":"new","label":"New CVE","at":"2026-10-13T19:18:48.000Z","detail":{"score":"5.6","severity":"MEDIUM","publishedAt":"2026-10-13T19:18:48.027Z"},"summary":"New CVE, medium severity (CVSS 5.6)."}],"references":[{"url":"https://github.com/mucommander/mucommander/blob/3bc2118e13681a8018b84a06f1c5fea4a3f940f7/mucommander-commons-file/src/main/java/com/mucommander/commons/file/AbstractFile.java#L1021-L1023","source":"disclosure@vulncheck.com"},{"url":"https://github.com/mucommander/mucommander/blob/3bc2118e13681a8018b84a06f1c5fea4a3f940f7/mucommander-core/src/main/java/com/mucommander/job/impl/UnpackJob.java#L233-L256","source":"disclosure@vulncheck.com"},{"url":"https://github.com/mucommander/mucommander/blob/3bc2118e13681a8018b84a06f1c5fea4a3f940f7/mucommander-protocol-sftp/src/main/java/com/mucommander/commons/file/protocol/sftp/SFTPFile.java#L586-L622","source":"disclosure@vulncheck.com"},{"url":"https://github.com/mucommander/mucommander/releases/tag/1.6.2-1","source":"disclosure@vulncheck.com"},{"url":"https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/ryH-CfoiMl","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/mucommander-through-1.6.2-path-traversal-via-archive-extraction-to-ftp-sftp","source":"disclosure@vulncheck.com"},{"url":"https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/ryH-CfoiMl","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-110231","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}