CVE-2026-110235 — MP Manager through 1.1.0 Path Traversal via Archive Extraction sanitizeEntryName Bypass
MP Manager through 1.1.0 contains a path traversal vulnerability that allows attackers to write files outside the extraction folder by bypassing the non-recursive sanitizeEntryN…
Published: 2026-10-13 · CVSS: 6.7 · CVSS 4.0
MP Manager through 1.1.0 contains a path traversal vulnerability that allows attackers to write files outside the extraction folder by bypassing the non-recursive sanitizeEntryName filter. Attackers can craft TAR, 7z or RAR entries named ....//file that become ../file, creating or overwriting files anywhere the app can write on shared storage.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7