CVE-2026-110231

Awaiting Analysis Awaiting Analysis - Queue

Path Traversal in muCommander via UnpackJob

Publication date: 2026-10-13

Last updated on: 2026-10-13

Assigner: VulnCheck

Description

muCommander through 1.6.2 contains a path traversal vulnerability in UnpackJob that allows attackers to write files outside the destination folder by bypassing its ZipSlip check with unnormalized remote paths. Attackers can craft TAR or ZIP entries like ../../.ssh/authorized_keys that, when extracted to FTP or SFTP folders, create or overwrite files writable by the user's remote account.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-13

Last Modified

2026-10-13

Generated

2026-10-19

AI Q&A

2026-10-14

EPSS Evaluated

2026-10-18

NVD

CVE-2026-110231

EUVD

EUVD-2026-99015

Affected Vendors & Products

Vendor	Product	Version / Range
muCommander	muCommander	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

This vulnerability is a path traversal issue in muCommander through version 1.6.2. It occurs during archive extraction to FTP or SFTP servers. The UnpackJob component fails to properly validate destination paths, allowing attackers to bypass ZipSlip checks using unnormalized remote paths. By crafting malicious TAR or ZIP entries like ../../.ssh/authorized_keys, attackers can write files outside the intended directory, potentially overwriting sensitive files or gaining unauthorized access.

Detection Guidance

To detect this vulnerability, inspect muCommander logs for archive extractions to FTP/SFTP destinations. Check for unnormalized paths containing .. or unusual file writes outside intended directories. Review files like .ssh/authorized_keys or configuration files in remote directories for unexpected modifications.

Impact Analysis

This vulnerability allows attackers to create or overwrite files in writable remote directories. Potential impacts include overwriting configuration files, deployment artifacts, or SSH-related files like authorized_keys. This could lead to unauthorized access, data breaches, or remote code execution if critical system files are modified. Exploitation requires the victim to manually extract a malicious archive to an FTP/SFTP destination.

Mitigation Strategies

Immediately update muCommander to the latest patched version. Disable archive extraction to remote FTP/SFTP destinations if not required. Implement strict path validation for archive entries and normalize all paths before extraction. Monitor remote directories for unauthorized file writes.

Hi! I’m here to help you understand CVE-2026-110231. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70