Path Traversal Vulnerability in muCommander

CVE-2026-110231

What is CVE-2026-110231?

muCommander versions up to 1.6.2 contain a path traversal vulnerability within the UnpackJob module. This issue allows attackers to bypass the ZipSlip check using unnormalized remote paths, capable of writing files to unintended directories. By crafting malicious TAR or ZIP entries, such as ../../.ssh/authorized_keys, an attacker could extract files to sensitive FTP or SFTP directories, resulting in potential unauthorized file modifications or creations. This vulnerability underscores the importance of securing file extraction processes to prevent unauthorized access to critical file systems.

References