CVE-2026-110235 in MP Manager
Summary
by MITRE • 10/13/2026
MP Manager through 1.1.0 contains a path traversal vulnerability that allows attackers to write files outside the extraction folder by bypassing the non-recursive sanitizeEntryName filter. Attackers can craft TAR, 7z or RAR entries named ....//file that become ../file, creating or overwriting files anywhere the app can write on shared storage.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/13/2026
The vulnerability identified in MP Manager versions through 1.1.0 represents a critical path traversal flaw rooted in inadequate input sanitization during archive extraction processes. This security defect allows remote attackers to execute arbitrary file writes outside of the intended target directory, effectively bypassing standard containment mechanisms designed to isolate extracted content. The core technical failure lies within the sanitizeEntryName filter, which is implemented as non-recursive. While this filter attempts to neutralize path traversal sequences such as dot-dot-slash (../) or their URL-encoded variants, it fails to process nested or repeated instances of these characters. Consequently, an attacker can craft malicious archive entries using patterns like ....//file, where the initial sanitization step removes only a portion of the traversal sequence, leaving behind ../ which then resolves to a parent directory relative to the extraction root.
From a technical perspective, this flaw exploits the fundamental difference between string manipulation and path resolution logic. When an archive containing such crafted entries is processed by MP Manager, the application extracts files based on the sanitized names without fully validating that the resulting absolute paths remain within the designated sandbox or shared storage directory. This oversight permits the creation of new files or the overwriting of existing ones in arbitrary locations accessible to the application process. The impact extends beyond simple data corruption; an attacker with access to a malicious archive can potentially overwrite configuration files, inject executable scripts, or manipulate system-critical documents located on shared storage volumes.
The operational impact of this vulnerability is significant due to its potential for privilege escalation and code execution depending on the context in which MP Manager operates. If the application runs with elevated privileges or has write access to sensitive directories such as program installation folders or user home directories, an attacker could achieve remote code execution by replacing legitimate binaries or scripts that are subsequently executed by higher-privileged processes. Even without elevation, the ability to overwrite files on shared storage can lead to data integrity violations, denial of service through file deletion or corruption, and potential lateral movement within a network if critical configuration files are compromised. This type of attack is particularly dangerous because it relies on user interaction with untrusted archives, making social engineering a viable vector for exploitation.
In terms of industry classification standards, this vulnerability aligns closely with CWE-22: Improper Limitation of a Pathname to a Restricted Directory. The failure to properly canonicalize or validate file paths before writing constitutes a classic directory traversal issue where the application does not enforce strict boundaries on user-supplied input. Furthermore, from an offensive security perspective as defined by MITRE ATT&CK, this technique falls under T1083: File and Directory Discovery combined with T1564: Host File System Modification. The attacker utilizes file system manipulation to alter the state of the host environment, potentially establishing persistence or disrupting operations.
Mitigation strategies must focus on both immediate remediation and long-term architectural improvements. For users currently running MP Manager 1.1.0 or earlier, upgrading to a patched version that implements recursive sanitization is the primary recommendation. Developers should ensure that all archive entry names are fully canonicalized before processing, ensuring that any resulting path resolves strictly within the intended extraction directory. Implementing strict allow-lists for file extensions and validating absolute paths against a base directory prefix using robust cryptographic hashing or standard library functions can prevent such bypasses. Additionally, running applications with minimal necessary permissions limits the blast radius of successful exploitation by restricting write access to only those directories absolutely required for operation.