CVE-2026-110235

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-110235
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-110235.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-110235
Published
2026-10-13T18:50:16Z
Modified
2026-10-15T07:07:32Z
Severity
  • 6.7 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
MP Manager through 1.1.0 Path Traversal via Archive Extraction sanitizeEntryName Bypass
Details

MP Manager through 1.1.0 contains a path traversal vulnerability that allows attackers to write files outside the extraction folder by bypassing the non-recursive sanitizeEntryName filter. Attackers can craft TAR, 7z or RAR entries named ....//file that become ../file, creating or overwriting files anywhere the app can write on shared storage.

Database specific 
{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-22"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/110xxx/CVE-2026-110235.json"
}
References

Affected packages

Git / github.com/abdurazaaqmohammed/mp-manager

Affected ranges

Type
GIT
Repo
https://github.com/abdurazaaqmohammed/mp-manager
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
592107e4bbe9da26bf10b3e22b023696324fb99f
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "last_affected":  "1.1.0"
        },
        {
            "fixed":  "1.1.0"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "DESCRIPTION",
        "REFERENCES"
    ]
}

Affected versions

0.*
0.1
1.*
1.0
1.0.1
1.0.2
1.0.3
1.0.4
1.0.5
1.0.6
1.0.7
1.0.8
1.0.9
Other
native-tools-v1
tool-packs-v1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-110235.json"
vanir_signatures 
[
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "78147755127826800394457601281695155249",
                "337476871605681145413870741481010914530",
                "53986970093291337221256272384139676263",
                "44410977465853094606633497537384977802",
                "280858745052192661462960314508352001829",
                "45008414948567803991843722129730655313",
                "121746152524320586350200124223890738825",
                "280131579672785673475453119084128978325",
                "972054121099916668564518825214785096",
                "267164255381730793698924932393969509572",
                "239807722574589728479025536463879001717",
                "263252825452503054143933916277486746027",
                "113231687831099336412864641616155171450",
                "1952983905998762739503078004871422793",
                "62770643481296440324056503622702495626",
                "297182480168174908862047097075733688988",
                "30356649635106376032122544696377503980",
                "86011686755458504065508211863999887808",
                "236589337162670545535032665236676519098",
                "119706380337453902352152023541858801564",
                "11803187722002204130786819702523760054",
                "63688939600132417596676640264787012489",
                "163246924116485740686944206476649800005",
                "60205472003001717917173218729536858563",
                "191377581587899993760962506856993695632",
                "199564265726368266007637277196910518611",
                "139240770613978177324145335787915634604",
                "244072099185202707316284470220232001930",
                "142224562872003359821960563890377598014",
                "222909192089183808522187789380694353173",
                "327393631960317750746611793738108440902",
                "65598342591268524255572904104110132452",
                "73826913898470464653147397314842077965",
                "5262419786949169529453859608973048533",
                "279780650275191117604361564220178740418",
                "316764021740767892483268685461634621881",
                "217709231323404557686160983870510634448",
                "100434306023099635121607646644002004733",
                "73911992325726711622310853375783143664",
                "220767016445076234399422137770756886708",
                "287688387663051837080656731285098431374",
                "253948564646838742656361577606700967535",
                "109336073735630280445093211649557736324",
                "235856150123918521800079622360180042510",
                "149915074179558328530904512151983455989",
                "43379892883311221725135122918566830014",
                "242951130589096891684463496728528367460",
                "282136787834660476206894207566523956751",
                "20637900912249420538954167798997884687",
                "23161853136731954816804199799390834387",
                "279793095527697525454175362423533537635",
                "337857981193366743637375067846454809934",
                "186551686531569540372956119235751969518",
                "272128412905720360356926197899523689256",
                "176563928732701405104564242323755865467",
                "292699243214580440812309201626850209648",
                "299431467916160482234753777412752298301",
                "326462917222552670506702815754116707291",
                "134495034634671888197684210026798708241",
                "172546831802821550805145257493472999968",
                "132454321721416534077298723241909946484",
                "284223161036783733279017837099411093937",
                "122647198449063140502838813603368873975",
                "20935920062374607217336066875767826544",
                "263523891005786979476017751723932325745",
                "167869437248973837423707818259810552729",
                "9311350756392705802220139791805378806",
                "136853478868990305658414327553920048049",
                "84920121478181273398481881884920624691",
                "291940036311724793906418021811277372487",
                "311041821590126316748558425203818198833",
                "143357139876170095652320623574760024037",
                "169299169173181623431497897326303170226",
                "290998271641889045022023019585528078257",
                "336399151248026511670107993228097801748",
                "333378858769261208692517364636249360937",
                "108192032504653133864650693470086428976",
                "222090547222173794025617290312690741859",
                "310492338000183966971329289949669241579",
                "187390825897863387777165823841962387663",
                "222793073305872218473552935125799103615",
                "286605223395426076847350895433064528362",
                "245641578620630720133987754450379656635",
                "154569251546892322588674075589007965594",
                "5472712615793477352001520880434624293",
                "251613267425113135130009167580234911801",
                "250391038293559618425615734257162511523",
                "169200073000306656214095387286388529063",
                "132067941421863538025874083510417294781",
                "210431063627895405026084348187347370125",
                "226530803586677229976425082642797289160",
                "63007430600021943364221555968034272171",
                "307700807523773256391280163550463985320",
                "254805834889862757560429318233607701149",
                "64976048117840980751920764029234974532",
                "162178818417946153885584011909127975267",
                "42298576143725228591339732959111342832",
                "136427193830442341343271751757770327522",
                "66303760763488493431897092477964941347",
                "291917042349097091944182169109031156646",
                "54072353701591434625483283979658292196",
                "73989020445534382778099430719785889104",
                "170849297975475172356953139713167239245",
                "198927089909959644120909331143873216539",
                "206958150471572942062029655911817400724",
                "158795942224570698405969557973890882651",
                "241059508446442685940738497928514561548",
                "26332622140641429638287778505729848775",
                "309133830888542227727463869591340669465",
                "7884655253786760430796892009519739368",
                "58419203179139716804528547479592802701",
                "308498930651479929392061874956429752161"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-110235-cfb38343",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/abdurazaaqmohammed/mp-manager/commit/592107e4bbe9da26bf10b3e22b023696324fb99f",
        "target":  {
            "file":  "app/src/main/java/io/github/abdurazaaqmohammed/utils/UpdateUtil.java"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "119834550526456924652805293990025397904",
            "length":  469
        },
        "id":  "CVE-2026-110235-d4c29b6c",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/abdurazaaqmohammed/mp-manager/commit/592107e4bbe9da26bf10b3e22b023696324fb99f",
        "target":  {
            "file":  "app/src/main/java/io/github/abdurazaaqmohammed/utils/UpdateUtil.java",
            "function":  "getHttpURLConnection"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "93775774142403875811733925144406867813",
            "length":  3415
        },
        "id":  "CVE-2026-110235-d6ff5926",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/abdurazaaqmohammed/mp-manager/commit/592107e4bbe9da26bf10b3e22b023696324fb99f",
        "target":  {
            "file":  "app/src/main/java/io/github/abdurazaaqmohammed/utils/UpdateUtil.java",
            "function":  "checkForUpdates"
        }
    }
]
vanir_signatures_modified 
"2026-10-15T07:07:32Z"