Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-110232— Fossify File Manager through 1.6.2 Zip Slip Path Traversal via DecompressActivity

Quick assessment

Affected
Fossify Fossify File Manager
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Fossify 文件管理器（版本 1.6.2 及更早版本）存在路径遍历漏洞，攻击者可以通过构造特殊的 ZIP 归档文件，绕过未锚定的 startsWith 检查，从而将文件写入提取目录之外的位置。当用户解压缩该归档文件时，攻击者可以提交类似 ../<name>_x/file 的归档条目，以在父级文件夹中创建或覆盖文件。

CVSS 3.3 · Low

Possible ATT&CK Techniques 1 AI

T1030 · Data Transfer Size Limits

Affected Version Matrix 1

VendorProduct Version RangeStatus
Fossify Fossify File Manager ≤ 1.6.2 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-110232

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Fossify File Manager through 1.6.2 Zip Slip Path Traversal via DecompressActivity
Source: CVE Program / CVE List V5
Vulnerability Description
Fossify File Manager through 1.6.2 contains a path traversal vulnerability that allows crafted ZIP archives to write files outside the extraction folder by bypassing an unanchored startsWith check. Attackers can supply archive entries like ../<name>_x/file to create or overwrite files in sibling folders when a user extracts the archive.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Fossify Fossify File Manager 0 ~ 1.6.2 -

II. Public POCs for CVE-2026-110232

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-110232

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-110232 (1)

Proof of Concept for CVE-2026-110232 (1)

Other References for CVE-2026-110232 (1)

IV. Related Vulnerabilities

Same weakness: CWE-22

V. Comments for CVE-2026-110232

No comments yet

Leave a comment