Fossify File Manager EUVD-2026-99016

Exploitation requires the victim to obtain a specially crafted ZIP archive on their device and manually extract it using Fossify File Manager's decompress feature (DecompressActivity) - this UI:A requirement and the AV:L local vector are the primary limiting factors. The specific trigger is the unanchored startsWith validation in the extraction path check, which crafted entries of the form ../<name>_x/file bypass to escape the chosen extraction folder. No authentication or special app configuration is needed; the flaw affects the default extraction behavior of versions through 1.6.2. There is no remote network vector and no code execution demonstrated - impact is limited to file creation/overwrite in folders writable by the app.

This is a genuinely low-to-moderate priority issue despite the CWE-22 path traversal classification. The provided CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N) scores 4.6 (Medium) and tells a consistent, non-alarming story: the attack is local (AV:L) rather than network-facing, requires active user interaction (UI:A - the victim must manually extract a malicious archive), and yields only Limited integrity impact (VI:L) with no confidentiality or availability impact. No EPSS score, no CISA KEV listing, and no explicit POC flag were supplied, so there is no signal of active or probable exploitation - though a detailed VulnCheck advisory and a HackMD technical writeup exist, which lowers the barrier to developing a working exploit. The signals do not conflict: a local, user-interaction-gated, integrity-only flaw in a niche open-source Android app is exactly the kind of 'valid but not urgent' bug that warrants patching on a normal cycle rather than emergency response. One caveat for defenders: the impact is bounded to writing/overwriting files in sibling folders - no code execution is demonstrated in the available data - but an attacker who can overwrite app-accessible files could potentially tamper with other data the app can reach.

An attacker distributes a crafted ZIP archive (via messaging, email, or a download) containing entries named like ../<name>_x/file that defeat the app's unanchored startsWith path check. When the victim opens the archive in Fossify File Manager and taps extract, the decompression routine writes attacker-controlled files into folders adjacent to the intended extraction directory, creating or overwriting files outside the target. No weaponized exploit code is flagged in the input, but public technical writeups (VulnCheck, HackMD) describe the bypass in detail.