CVE-2026-110231: muCommander through 1.6.2 Path Traversal via Archive Extraction to FTP/SFTP
muCommander through 1.6.2 contains a path traversal vulnerability in UnpackJob that allows attackers to write files outside the destination folder by bypassing its ZipSlip check with unnormalized remote paths. Attackers can craft TAR or ZIP entries like ../../.ssh/authorizedkeys that, when extracted to FTP or SFTP folders, create or overwrite files writable by the user's remote account.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users of muCommander through 1.6.2 are exposed when they extract a malicious TAR or ZIP archive into an FTP or SFTP folder. The impact is limited to files that the user’s remote account is permitted to write or overwrite.
What must an attacker do to exploit it?
An attacker must provide a crafted TAR or ZIP archive containing traversal entry names, such as ../../.ssh/authorized_keys, and persuade a user to extract it to an FTP or SFTP destination. User interaction is required.
Are local archive extractions affected?
The available information specifically identifies extraction to FTP or SFTP folders. It does not establish that extraction to local destinations is affected.
What can be done if patching is not immediately possible?
Avoid extracting untrusted TAR or ZIP archives to FTP or SFTP destinations with muCommander. Use remote accounts with minimal write permissions and review sensitive writable locations, such as .ssh directories, for unexpected files or modifications.
How can I check for potential exploitation?
Review files writable by the affected remote account outside intended extraction folders for unexpected creations or overwrites. Pay particular attention to sensitive paths that could be targeted by traversal entries, including .ssh/authorized_keys.