MP Manager CVE-2026-110235

Exploitation requires the victim to manually extract an attacker-crafted TAR, 7z, or RAR archive within MP Manager (through version 1.1.0); the malicious archive must contain an entry named using the '....//file' pattern that defeats the non-recursive sanitizeEntryName filter and collapses to '../file'. The flaw works against default behavior (no special app configuration is needed), but it is strictly limited by the requirement for local user interaction - the attacker cannot trigger extraction remotely or without the user opening the archive - and by the scope of what MP Manager can write on shared storage. Impact is confined to file creation/overwrite (integrity); no confidentiality or availability impact applies.

The signals are consistent and point to a moderate, non-urgent risk. The CVSS 4.0 vector (AV:L/AC:L/PR:N/UI:A, VI:H only) describes a local, user-interaction-dependent file-write flaw with high integrity impact but no confidentiality or availability impact, yielding a 6.7 (Medium) score. This aligns with the SSVC assessment: Exploitation=poc (proof-of-concept, not active), Automatable=no (each attack requires a victim to manually extract a crafted archive, so it cannot be mass-automated), and Technical Impact=partial. There is no CISA KEV listing and no EPSS score was provided in the input, so there is no evidence of widespread or opportunistic exploitation. The limiting factor is significant: an attacker cannot exploit this remotely or silently - a user must choose to extract an attacker-supplied TAR/7z/RAR inside MP Manager. This is therefore a legitimate but low-priority issue: a real, confirmed-with-PoC bug in a niche hobbyist Android app rather than a broadly exploitable threat. Note the input provides no EPSS value, so probabilistic exploitation likelihood could not be cross-referenced.

An attacker distributes a malicious archive (via download, messaging, or a shared file) containing an entry named like '....//payload' that bypasses the non-recursive sanitizeEntryName filter and resolves to '../payload'. When a victim extracts the archive using MP Manager (through v1.1.0), the file is written outside the intended extraction folder, letting the attacker create or overwrite files anywhere the app can write on shared storage. A public proof-of-concept is referenced (SSVC Exploitation=poc, with a VulnCheck advisory and hackmd write-up); exploitation requires local user interaction (UI:A) rather than remote access.