CVE-2026-110232: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Fossify Fossify File Manager

CVE-2026-110232 describes a path traversal vulnerability in Fossify File Manager through version 1.6.2. The vulnerability arises because the software uses an unanchored startsWith check to restrict extraction paths, which can be bypassed by specially crafted ZIP archive entries containing relative path components (e.g., '../'). This allows an attacker to write files outside the extraction folder, potentially overwriting arbitrary files in sibling directories during archive extraction.

An attacker can supply a malicious ZIP archive that, when extracted by a user, writes or overwrites files outside the intended extraction directory. This could lead to unauthorized file modification or creation in sibling directories. The vulnerability requires user interaction (UI:A) and local access (AV:L), and does not allow privilege escalation or remote code execution directly. The overall impact is rated medium.

No official patch or fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid extracting untrusted ZIP archives with Fossify File Manager and consider using alternative extraction tools that properly validate archive paths.