CVE-2026-110232: Fossify File Manager through 1.6.2 Zip Slip Path Traversal via DecompressActivity

Q: Who is exposed to this issue?

Users of Fossify File Manager through version 1.6.2 are exposed when they extract a crafted ZIP archive. Exploitation requires local interaction because the user must extract the archive.

Q: What does an attacker need to exploit it?

An attacker needs to provide a malicious ZIP archive containing traversal-style entry names, such as ../<name>_x/file. When the archive is extracted, those entries can write outside the selected extraction folder into sibling folders.

Published Oct 13, 2026

Updated

Fossify File Manager through 1.6.2 contains a path traversal vulnerability that allows crafted ZIP archives to write files outside the extraction folder by bypassing an unanchored startsWith check. Attackers can supply archive entries like ../<name>x/file to create or overwrite files in sibling folders when a user extracts the archive.

Affected Software

1 affected component

Fossify File Manager<=1.6.2

Event History

Oct 13, 2026

CVE Published

via MITRE·06:50 PM

Data Sourced

via MITRE·06:50 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

Users of Fossify File Manager through version 1.6.2 are exposed when they extract a crafted ZIP archive. Exploitation requires local interaction because the user must extract the archive.

What does an attacker need to exploit it?

An attacker needs to provide a malicious ZIP archive containing traversal-style entry names, such as ../<name>_x/file. When the archive is extracted, those entries can write outside the selected extraction folder into sibling folders.

What is the impact of a successful exploit?

A crafted archive can create or overwrite files outside the intended extraction directory. The reported impact is limited to integrity; no confidentiality or availability impact is specified.