CVE-2026-110235
MEDIUM
6,7
Source: [email protected]
Attack Vector: local
Attack Complexity: low
Privileges Required: none
User Interaction: active
Confidentiality: N/A
Integrity: N/A
Availability: N/A
MEDIUM
5,5
Source: [email protected]
Attack Vector: local
Attack Complexity: low
Privileges Required: none
User Interaction: required
Scope: unchanged
Confidentiality: none
Integrity: high
Availability: none
Description
AI Translation Available
MP Manager through 1.1.0 contains a path traversal vulnerability that allows attackers to write files outside the extraction folder by bypassing the non-recursive sanitizeEntryName filter. Attackers can craft TAR, 7z or RAR entries named ....//file that become ../file, creating or overwriting files anywhere the app can write on shared storage.
22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
StableCommon Consequences
Security Scopes Affected:
Integrity
Confidentiality
Availability
Potential Impacts:
Execute Unauthorized Code Or Commands
Modify Files Or Directories
Read Files Or Directories
Dos: Crash, Exit, Or Restart
Applicable Platforms
Technologies:
AI/ML
https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/S161BQjoMx
https://github.com/AbdurazaaqMohammed/MP-Manager/blob/592107e4bbe9da26bf10b3e22…
https://github.com/AbdurazaaqMohammed/MP-Manager/blob/592107e4bbe9da26bf10b3e22…
https://github.com/AbdurazaaqMohammed/MP-Manager/releases/tag/1.1.0
https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/S161BQjoMx
https://www.vulncheck.com/advisories/mp-manager-through-1.1.0-path-traversal-vi…