CVE-2026-96884 in MantisZip
Summary
by MITRE • 09/24/2026
A security flaw has been discovered in MantisZip up to 0.4.5. Affected by this issue is the function Path.Combine of the file MainWindow.UI.cs of the component Preview. The manipulation results in path traversal. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/24/2026
The vulnerability identified in MantisZip versions up to 0.4.5 represents a critical path traversal flaw rooted in improper handling of file system paths within the application's preview component. Specifically, the defect resides in the MainWindow.UI.cs file where the Path.Combine method is utilized without adequate sanitization or validation of user-supplied input. This architectural oversight allows an attacker to manipulate directory structures by injecting special characters such as dot-dot-slash sequences into filenames or path parameters. When the application processes these inputs, it fails to normalize them correctly before combining them with base directories, thereby enabling access to files and directories that reside outside the intended scope of the application's working directory. This type of flaw is classically categorized under CWE-22: Improper Limitation of a Pathname to a Restricted Directory, which highlights the failure to restrict file system operations to authorized locations.
The operational impact of this vulnerability is significant due to its potential for remote exploitation. Although MantisZip is primarily a desktop application used for compressing and decompressing files, the ability to launch attacks remotely suggests that the software may be processing untrusted input from network sources or integrated services without sufficient security checks. An attacker who can influence the file paths processed by this component could potentially read sensitive configuration files, access private user data stored in adjacent directories, or overwrite critical system files if execution privileges allow. The existence of a public exploit further exacerbates the risk landscape, as it lowers the barrier to entry for malicious actors seeking to compromise systems running vulnerable versions of MantisZip. This aligns with ATT&CK technique T1083: File and Directory Discovery, where adversaries use discovered paths to gather information about the target environment, potentially leading to more severe consequences such as data exfiltration or lateral movement within a networked environment.
The lack of response from the project maintainers despite early notification through an issue report leaves users exposed during this window of vulnerability. In enterprise environments relying on MantisZip for file management workflows, this delay in patching necessitates immediate defensive measures to mitigate risk until an official update is released. Organizations should consider implementing strict input validation policies that reject any path components containing relative navigation sequences or null bytes. Additionally, deploying application whitelisting solutions can restrict the execution of untrusted binaries and limit the damage caused by successful exploitation attempts. It is also advisable to run MantisZip with restricted user privileges rather than administrative rights, thereby reducing the potential impact if a path traversal attack succeeds in accessing unauthorized files. Regular audits of third-party software dependencies are essential to ensure that known vulnerabilities do not persist in production environments for extended periods.