{"id":"CVE-2026-110235","summary":"MP Manager through 1.1.0 Path Traversal via Archive Extraction sanitizeEntryName Bypass","details":"MP Manager through 1.1.0 contains a path traversal vulnerability that allows attackers to write files outside the extraction folder by bypassing the non-recursive sanitizeEntryName filter. Attackers can craft TAR, 7z or RAR entries named ....//file that become ../file, creating or overwriting files anywhere the app can write on shared storage.","modified":"2026-10-15T07:07:32.625536034Z","published":"2026-10-13T18:50:16.736Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/110xxx/CVE-2026-110235.json","cna_assigner":"VulnCheck","cwe_ids":["CWE-22"]},"references":[{"type":"ADVISORY","url":"https://github.com/AbdurazaaqMohammed/MP-Manager/releases/tag/1.1.0"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/110xxx/CVE-2026-110235.json"},{"type":"ADVISORY","url":"https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/S161BQjoMx"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110235"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/mp-manager-through-1.1.0-path-traversal-via-archive-extraction-sanitizeentryname-bypass"},{"type":"PACKAGE","url":"https://github.com/AbdurazaaqMohammed/MP-Manager"},{"type":"ARTICLE","url":"https://github.com/AbdurazaaqMohammed/MP-Manager/blob/592107e4bbe9da26bf10b3e22b023696324fb99f/app/src/main/java/io/github/abdurazaaqmohammed/utils/ArchiveUtil.java#L134-L152"},{"type":"ARTICLE","url":"https://github.com/AbdurazaaqMohammed/MP-Manager/blob/592107e4bbe9da26bf10b3e22b023696324fb99f/app/src/main/java/io/github/abdurazaaqmohammed/utils/ArchiveUtil.java#L226-L231"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/abdurazaaqmohammed/mp-manager","events":[{"introduced":"0"},{"fixed":"592107e4bbe9da26bf10b3e22b023696324fb99f"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"last_affected":"1.1.0"},{"fixed":"1.1.0"}],"source":["AFFECTED_FIELD","DESCRIPTION","REFERENCES"]}}],"versions":["tool-packs-v1","1.0.9","1.0.8","native-tools-v1","1.0.7","1.0.6","1.0.5","1.0.4","1.0.3","1.0.2","1.0.1","1.0","0.1"],"database_specific":{"vanir_signatures_modified":"2026-10-15T07:07:32Z","source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-110235.json","vanir_signatures":[{"target":{"file":"app/src/main/java/io/github/abdurazaaqmohammed/utils/UpdateUtil.java"},"deprecated":false,"digest":{"line_hashes":["78147755127826800394457601281695155249","337476871605681145413870741481010914530","53986970093291337221256272384139676263","44410977465853094606633497537384977802","280858745052192661462960314508352001829","45008414948567803991843722129730655313","121746152524320586350200124223890738825","280131579672785673475453119084128978325","972054121099916668564518825214785096","267164255381730793698924932393969509572","239807722574589728479025536463879001717","263252825452503054143933916277486746027","113231687831099336412864641616155171450","1952983905998762739503078004871422793","62770643481296440324056503622702495626","297182480168174908862047097075733688988","30356649635106376032122544696377503980","86011686755458504065508211863999887808","236589337162670545535032665236676519098","119706380337453902352152023541858801564","11803187722002204130786819702523760054","63688939600132417596676640264787012489","163246924116485740686944206476649800005","60205472003001717917173218729536858563","191377581587899993760962506856993695632","199564265726368266007637277196910518611","139240770613978177324145335787915634604","244072099185202707316284470220232001930","142224562872003359821960563890377598014","222909192089183808522187789380694353173","327393631960317750746611793738108440902","65598342591268524255572904104110132452","73826913898470464653147397314842077965","5262419786949169529453859608973048533","279780650275191117604361564220178740418","316764021740767892483268685461634621881","217709231323404557686160983870510634448","100434306023099635121607646644002004733","73911992325726711622310853375783143664","220767016445076234399422137770756886708","287688387663051837080656731285098431374","253948564646838742656361577606700967535","109336073735630280445093211649557736324","235856150123918521800079622360180042510","149915074179558328530904512151983455989","43379892883311221725135122918566830014","242951130589096891684463496728528367460","282136787834660476206894207566523956751","20637900912249420538954167798997884687","23161853136731954816804199799390834387","279793095527697525454175362423533537635","337857981193366743637375067846454809934","186551686531569540372956119235751969518","272128412905720360356926197899523689256","176563928732701405104564242323755865467","292699243214580440812309201626850209648","299431467916160482234753777412752298301","326462917222552670506702815754116707291","134495034634671888197684210026798708241","172546831802821550805145257493472999968","132454321721416534077298723241909946484","284223161036783733279017837099411093937","122647198449063140502838813603368873975","20935920062374607217336066875767826544","263523891005786979476017751723932325745","167869437248973837423707818259810552729","9311350756392705802220139791805378806","136853478868990305658414327553920048049","84920121478181273398481881884920624691","291940036311724793906418021811277372487","311041821590126316748558425203818198833","143357139876170095652320623574760024037","169299169173181623431497897326303170226","290998271641889045022023019585528078257","336399151248026511670107993228097801748","333378858769261208692517364636249360937","108192032504653133864650693470086428976","222090547222173794025617290312690741859","310492338000183966971329289949669241579","187390825897863387777165823841962387663","222793073305872218473552935125799103615","286605223395426076847350895433064528362","245641578620630720133987754450379656635","154569251546892322588674075589007965594","5472712615793477352001520880434624293","251613267425113135130009167580234911801","250391038293559618425615734257162511523","169200073000306656214095387286388529063","132067941421863538025874083510417294781","210431063627895405026084348187347370125","226530803586677229976425082642797289160","63007430600021943364221555968034272171","307700807523773256391280163550463985320","254805834889862757560429318233607701149","64976048117840980751920764029234974532","162178818417946153885584011909127975267","42298576143725228591339732959111342832","136427193830442341343271751757770327522","66303760763488493431897092477964941347","291917042349097091944182169109031156646","54072353701591434625483283979658292196","73989020445534382778099430719785889104","170849297975475172356953139713167239245","198927089909959644120909331143873216539","206958150471572942062029655911817400724","158795942224570698405969557973890882651","241059508446442685940738497928514561548","26332622140641429638287778505729848775","309133830888542227727463869591340669465","7884655253786760430796892009519739368","58419203179139716804528547479592802701","308498930651479929392061874956429752161"],"threshold":0.9},"id":"CVE-2026-110235-cfb38343","signature_type":"Line","signature_version":"v1","source":"https://github.com/abdurazaaqmohammed/mp-manager/commit/592107e4bbe9da26bf10b3e22b023696324fb99f"},{"deprecated":false,"digest":{"function_hash":"119834550526456924652805293990025397904","length":469},"id":"CVE-2026-110235-d4c29b6c","signature_type":"Function","signature_version":"v1","source":"https://github.com/abdurazaaqmohammed/mp-manager/commit/592107e4bbe9da26bf10b3e22b023696324fb99f","target":{"function":"getHttpURLConnection","file":"app/src/main/java/io/github/abdurazaaqmohammed/utils/UpdateUtil.java"}},{"id":"CVE-2026-110235-d6ff5926","signature_type":"Function","signature_version":"v1","source":"https://github.com/abdurazaaqmohammed/mp-manager/commit/592107e4bbe9da26bf10b3e22b023696324fb99f","target":{"file":"app/src/main/java/io/github/abdurazaaqmohammed/utils/UpdateUtil.java","function":"checkForUpdates"},"deprecated":false,"digest":{"length":3415,"function_hash":"93775774142403875811733925144406867813"}}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N"}]}