CVE-2026-96884: MantisZip Preview MainWindow.UI.cs Path.Combine path traversal
A security flaw has been discovered in MantisZip up to 0.4.5. Affected by this issue is the function Path.Combine of the file MainWindow.UI.cs of the component Preview. The manipulation results in path traversal. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
Which deployments should be considered affected?
MantisZip versions up to and including 0.4.5 are identified as affected. The issue is in the Preview component.
What does an attacker need to exploit this issue?
The attack can be launched remotely and does not require prior privileges. User interaction is required for exploitation.
How much impact can successful exploitation have?
The supplied severity vector rates confidentiality, integrity, and availability impact as low. The vulnerability has a medium severity score of 6.3.
Is exploit activity a realistic concern?
A public exploit has been released and may be used in attacks. The provided record does not identify an available fix or a project response.