| शीर्षक | 螳螂卜禅 MantisZip 0.4.5 Path Traversal |
|---|
| विवरण | MantisZip v0.4.5 and all earlier versions suffer a Zip Slip (CWE-22 path traversal) vulnerability within its GUI double-click entry preview function. The program extracts archive entries to a constrained temporary folder for preview, yet it directly concatenates unsanitized attacker-controlled ZIP entry names with the temp directory via Path.Combine. Malicious archive entries containing "../" traversal sequences can escape the temporary sandbox, enabling arbitrary file write to any user-writable path on Windows systems.
Exploitation only requires low-complexity social engineering: the victim just needs to open the malicious ZIP and double-click any entry, with no authentication or elevated privileges required. Attackers can deploy persistent startup scripts, hijack DLLs, overwrite system configuration files, and achieve persistent remote code execution. The built-in path validation function is logically broken and cannot block traversal payloads, resulting in failed defense-in-depth. |
|---|
| स्रोत | ⚠️ https://gitee.com/yhx070424/MantisZip/issues/IK4AHB |
|---|
| उपयोगकर्ता | 0n1on (UID 100116) |
|---|
| सबमिशन | 26/07/2026 07:05 PM (2 महीनों पहले) |
|---|
| संयम | 23/09/2026 08:19 PM (2 months later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 409081 [MantisZip तक 0.4.5 Preview MainWindow.UI.cs Path.Combine निर्देशिका ट्रैवर्सल] |
|---|
| अंक | 20 |
|---|