Description
Fossify File Manager through 1.6.2 contains a path traversal vulnerability that allows crafted ZIP archives to write files outside the extraction folder by bypassing an unanchored startsWith check. Attackers can supply archive entries like ../<name>_x/file to create or overwrite files in sibling folders when a user extracts the archive.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Fossify Fossify File Manager
Default version status: unaffected
0 to ≤ 1.6.2affected
References
- https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/Hk2woGjsze ↗
- https://github.com/FossifyOrg/File-Manager/blob/82b3c98c9a7b90d8af2c2ff0c39c87f5917e1b08/app/src/main/kotlin/org/fossify/filemanager/activities/DecompressActivity.kt#L161-L189 ↗
- https://github.com/FossifyOrg/File-Manager/releases/tag/1.6.2 ↗
- https://www.vulncheck.com/advisories/fossify-file-manager-through-1.6.2-zip-slip-path-traversal-via-decompressactivity ↗