CVE-2026-96884 is a path traversal vulnerability affecting MantisZip up to version 0.4.5. The issue resides in the Path.Combine function of the MainWindow.UI.cs file in the Preview component. This flaw enables remote attackers to manipulate file paths, leading to path traversal attacks. The vulnerability has been publicly disclosed along with exploit code. The project was notified early but has not yet provided a fix or official response.

Successful exploitation of this vulnerability allows remote attackers to perform path traversal, potentially accessing or manipulating files outside the intended directories. This can lead to unauthorized information disclosure or modification. The vulnerability has a medium severity rating (CVSS 5.3) and is exploitable remotely without privileges or user interaction.

As of the publication date, no official fix or patch is available from the vendor. Users should monitor the project for updates and consider implementing network-level protections to restrict access to the vulnerable component. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.