Path Traversal Vulnerability in Fossify File Manager by Fossify

CVE-2026-110232

What is CVE-2026-110232?

The Fossify File Manager version 1.6.2 is affected by a path traversal vulnerability that enables attackers to exploit crafted ZIP files. By bypassing an unanchored startsWith check, this weakness allows the extraction process to write files outside of the intended extraction directory. Attackers can manipulate archive entries, for instance, using the format ../_x/file, to create or overwrite files in potentially sensitive sibling directories. This vulnerability exposes users to unauthorized file access and manipulation risks.

References