muCommander EUVD-2026-99015

Exploitation requires the victim to actively use muCommander's archive-extraction (UnpackJob) feature to extract an attacker-supplied TAR or ZIP archive, AND the chosen extraction destination must be a remote FTP or SFTP folder; the malicious archive must contain entries with unnormalized relative paths (e.g. '../../.ssh/authorized_keys') that evade the ZipSlip check in AbstractFile. Limiting factors: active user interaction is mandatory (the user must open and extract the archive), the attack only yields files writable by the victim's existing remote FTP/SFTP account (no privilege gain beyond that account), and it depends on the non-default workflow of extracting into a live remote-protocol connection rather than the local filesystem. There is no confidentiality or availability impact - only arbitrary file creation/overwrite (integrity).

This is a moderate, conditional risk rather than an urgent priority. The vendor-supplied CVSS 4.0 vector (AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N) describes a local-vector, integrity-only flaw that requires active user interaction (UI:A) and carries an Attack Requirement (AT:P), meaning exploitation depends on a specific precondition - the extraction destination being a remote FTP/SFTP folder. There is no CVSS confidentiality or availability impact; the sole impact is high integrity (arbitrary file write/overwrite). No EPSS score was provided in the input, so exploitation probability cannot be quantified. The CVE is NOT listed in CISA KEV and no exploit-code flag was supplied, so this is 'no public exploit identified at time of analysis' - though a VulnCheck advisory and a HackMD technical write-up exist as references, these are analyses, not confirmed weaponized exploits, and POC availability must not be conflated with active exploitation. Signals are internally consistent (local, user-driven, integrity-only), so there is no AV:N-vs-description conflict to flag. The practical risk: an attacker who can seed a victim with a malicious archive AND rely on the victim extracting it to a writable remote account can plant files such as ~/.ssh/authorized_keys, which could escalate to remote-account takeover - but this chain requires several attacker-favorable conditions, keeping real-world risk in the medium band despite the serious potential consequence.

An attacker distributes a crafted TAR or ZIP archive containing an entry whose path is unnormalized (e.g. '../../.ssh/authorized_keys'), bypassing muCommander's ZipSlip check. A victim opens the archive in muCommander and extracts it into a connected FTP or SFTP folder; the entry is written outside the intended destination, overwriting a file owned by the victim's remote account (such as authorized_keys), potentially granting the attacker SSH access. No public exploit code was identified, though a VulnCheck advisory and HackMD write-up document the technique.