Medium severity · published Oct 13, 2026
CVE-2026-110231
muCommander through 1.6.2 Path Traversal via Archive Extraction to FTP/SFTP
4.7
CVSS
0.3%
EPSS
No
On KEV
Description
muCommander through 1.6.2 contains a path traversal vulnerability in UnpackJob that allows attackers to write files outside the destination folder by bypassing its ZipSlip check with unnormalized remote paths. Attackers can craft TAR or ZIP entries like ../../.ssh/authorized_keys that, when extracted to FTP or SFTP folders, create or overwrite files writable by the user's remote account.
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N
Attack vector
Local
Complexity
High
Privileges
None
User interaction
Required
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 20% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MU
muCommander · muCommander
through 1.6.2 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-110231
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-110231
third-party-advisory
https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/ryH-CfoiMl
technical-description
https://github.com/mucommander/mucommander/blob/3bc2118e13681a8018b84a06f1c5fea4a3f940f7/mucommander-core/src/main/java/com/mucommander/job/impl/UnpackJob.java#L233-L256
technical-description
https://github.com/mucommander/mucommander/blob/3bc2118e13681a8018b84a06f1c5fea4a3f940f7/mucommander-commons-file/src/main/java/com/mucommander/commons/file/AbstractFile.java#L1021-L1023
technical-description
https://github.com/mucommander/mucommander/blob/3bc2118e13681a8018b84a06f1c5fea4a3f940f7/mucommander-protocol-sftp/src/main/java/com/mucommander/commons/file/protocol/sftp/SFTPFile.java#L586-L622
release-notes
https://github.com/mucommander/mucommander/releases/tag/1.6.2-1
third-party-advisory
https://www.vulncheck.com/advisories/mucommander-through-1.6.2-path-traversal-via-archive-extraction-to-ftp-sftp
More from muCommander
–
CVE-2008-1970
muCommander before 0.8.2 stores credentials.xml with insecure permissions, which allows local users to obtain credentials