Vulnerability · Published Oct 13, 2026 · Assigned by VulnCheck
CVE-2026-110232Fossify File Manager through 1.6.2 Zip Slip Path Traversal via DecompressActivity
Low 3.3
In plain English
A low-severity path traversal in Fossify File Manager from Fossify. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 11% of all known vulnerabilities).
Severity (CVSS 3.1)3.3Low
Exploit odds (30 days)0.2%top 89.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Fossify File Manager through 1.6.2 contains a path traversal vulnerability that allows crafted ZIP archives to write files outside the extraction folder by bypassing an unanchored startsWith check. Attackers can supply archive entries like ../<name>_x/file to create or overwrite files in sibling folders when a user extracts the archive.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Fossify | Fossify File Manager | 0 – through 1.6.2 |
Weakness: CWE-22 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
References
- https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/Hk2woGjsze third-party-advisory
- https://github.com/FossifyOrg/File-Manager/blob/82b3c98c9a7b90d8af2c2ff0c39c87f5917e1b08/app/src/main/kotlin/org/fossify/filemanager/activities/DecompressActivity.kt#L161-L189 technical-description
- 1.6.2 Release Notes release-notes
- VulnCheck Advisory: Fossify File Manager through 1.6.2 Zip Slip Path Traversal via DecompressActivity third-party-advisory