MantisZip CVE-2026-96884

Exploitation requires the victim to open an attacker-supplied archive in MantisZip (versions up to 0.4.5) and invoke the Preview component, which triggers the vulnerable Path.Combine call in MainWindow.UI.cs; the archive must contain crafted entry paths with directory-traversal sequences. The primary limiting factor is required user interaction (UI:P) - no automatic or server-side exploitation path is indicated because this is a client-side desktop archive tool, not a network service. No authentication is involved (PR:N) since the attack is against a local user opening a file, but successful attack hinges entirely on social-engineering the victim into previewing the malicious archive.

This is a low-to-moderate real-world risk. The input CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L, score 5.3) shows unauthenticated network reachability but requires user interaction (UI:P) and yields only Low impact across confidentiality, integrity and availability with no scope change. SSVC-style signals: exploitation is 'proof-of-concept' (E:P in the vector), a public exploit exists (VulDB/gitee), but there is NO CISA KEV listing and no EPSS score was provided, so there is no evidence of widespread or automated exploitation. Crucially, MantisZip is a GUI archive utility (MainWindow.UI.cs / Preview component), so 'remotely' realistically means delivering a malicious archive that a victim opens and previews - the AV:N labeling is generous and the UI:P requirement is the true gating factor. Net: a publicly-disclosed but low-impact path traversal in an obscure hobby product; a low remediation priority relative to KEV-listed or high-impact flaws, mitigated further by the vendor being unresponsive (no patch available) which is the main open concern rather than exploitation pressure.

An attacker crafts a malicious ZIP/archive whose entry paths contain traversal sequences (e.g. ../../) and sends it to a victim, who opens it in MantisZip and uses the Preview feature; the Path.Combine call in MainWindow.UI.cs resolves the crafted path outside the intended extraction/preview directory, allowing read or write of files outside the archive scope. A public proof-of-concept exists (published via the vendor's gitee issue tracker), lowering the skill required, though exploitation still depends on the user opening and previewing the attacker-supplied archive.