CVE-2026-110235: MP Manager through 1.1.0 Path Traversal via Archive Extraction sanitizeEntryName Bypass
MP Manager through 1.1.0 contains a path traversal vulnerability that allows attackers to write files outside the extraction folder by bypassing the non-recursive sanitizeEntryName filter. Attackers can craft TAR, 7z or RAR entries named ....//file that become ../file, creating or overwriting files anywhere the app can write on shared storage.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Installations of MP Manager through version 1.1.0 are affected when they extract attacker-controlled TAR, 7z, or RAR archives. The impact is limited by the filesystem locations the application can write to on shared storage.
What does an attacker need to exploit it?
An attacker needs to induce a user to extract a crafted archive. The archive must include an entry such as "....//file", which bypasses the non-recursive name sanitization and is transformed into "../file".
What can happen after successful exploitation?
A crafted archive can cause files to be created or overwritten outside the intended extraction directory. This can affect any writable location accessible to the application on shared storage.
What can be done until a fix is available?
Do not extract untrusted TAR, 7z, or RAR archives with MP Manager. Restrict the application's write permissions and shared-storage access so that an archive escape cannot overwrite sensitive files.