CVE-2026-110231

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-110231
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-110231.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-110231
Published
2026-10-13T18:50:14Z
Modified
2026-10-15T02:47:27Z
Severity
  • 5.6 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
muCommander through 1.6.2 Path Traversal via Archive Extraction to FTP/SFTP
Details

muCommander through 1.6.2 contains a path traversal vulnerability in UnpackJob that allows attackers to write files outside the destination folder by bypassing its ZipSlip check with unnormalized remote paths. Attackers can craft TAR or ZIP entries like ../../.ssh/authorized_keys that, when extracted to FTP or SFTP folders, create or overwrite files writable by the user's remote account.

Database specific 
{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-22"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/110xxx/CVE-2026-110231.json"
}
References

Affected packages

Git / github.com/mucommander/mucommander

Affected ranges

Type
GIT
Repo
https://github.com/mucommander/mucommander
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
3bc2118e13681a8018b84a06f1c5fea4a3f940f7
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "last_affected":  "1.6.2"
        },
        {
            "fixed":  "1.6.2"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "DESCRIPTION",
        "REFERENCES"
    ]
}

Affected versions

0.*
0.9.3
0.9.3-1
0.9.3-3
0.9.6
0.9.7
1.*
1.0.1
1.1.0
1.3.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-110231.json"