CVE-2026-110232

LOW 3.3

Fossify File Manager through 1.6.2 Zip Slip Path Traversal via DecompressActivity

CVSS Score

3.3

EPSS Score

0.0%

EPSS Percentile

0th

Fossify File Manager through 1.6.2 contains a path traversal vulnerability that allows crafted ZIP archives to write files outside the extraction folder by bypassing an unanchored startsWith check. Attackers can supply archive entries like ../<name>_x/file to create or overwrite files in sibling folders when a user extracts the archive.

CWE	CWE-22
Vendor	fossify
Product	fossify file manager
Published	Oct 13, 2026

Stay Ahead of the Next One

Get instant alerts for fossify fossify file manager

Be the first to know when new low vulnerabilities affecting fossify fossify file manager are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Affected Versions

Fossify / Fossify File Manager

0 ≤ 1.6.2

References

NVD ↗ CVE.org ↗ EPSS Data ↗

hackmd.io: https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/Hk2woGjsze github.com: https://github.com/FossifyOrg/File-Manager/blob/82b3c98c9a7b90d8af2c2ff0c39c87f5917e1b08/app/src/main/kotlin/org/fossify/filemanager/activities/DecompressActivity.kt#L161-L189 github.com: https://github.com/FossifyOrg/File-Manager/releases/tag/1.6.2 vulncheck.com: https://www.vulncheck.com/advisories/fossify-file-manager-through-1.6.2-zip-slip-path-traversal-via-decompressactivity

Credits

hieuPenguinnn