CVE-2026-96884 Overview
CVE-2026-96884 is a path traversal vulnerability [CWE-22] in MantisZip versions up to 0.4.5. The flaw resides in the Path.Combine function within MainWindow.UI.cs, part of the Preview component. Attackers can manipulate file paths to access files outside the intended directory. The vulnerability is reachable over the network and requires user interaction to trigger. A public exploit has been released, increasing the likelihood of opportunistic abuse. The project maintainers were notified through an issue report but have not responded as of publication.
Critical Impact
Remote attackers can leverage crafted archive content to traverse directories and access or write files outside the intended extraction path.
Affected Products
- MantisZip versions up to and including 0.4.5
- Component: Preview functionality in MainWindow.UI.cs
- Affected function: Path.Combine
Discovery Timeline
- 2026-09-24 - CVE-2026-96884 published to the National Vulnerability Database (NVD)
- 2026-09-24 - Last updated in NVD database
Technical Details for CVE-2026-96884
Vulnerability Analysis
The vulnerability stems from unsafe use of Path.Combine in the Preview component of MantisZip. When the application processes archive entries, filenames containing traversal sequences such as ..\ or absolute paths are not validated before being combined with the destination directory. As a result, the resolved path can escape the intended working directory.
Attackers can craft a malicious archive containing entries with traversal payloads. When a user previews or interacts with the archive, the application resolves file paths outside the sandbox. This enables read or write operations against arbitrary locations on the host file system, subject to the permissions of the running user.
The exploit has been publicly released, and the project has not issued a fix. See the Gitee Issue Report and the VulDB entry for CVE-2026-96884 for additional context.
Root Cause
The root cause is the behavior of .NET's Path.Combine when supplied with a rooted or traversal-containing second argument. Path.Combine returns the second path unchanged when it is rooted, which bypasses the intended directory containment. MantisZip does not canonicalize or validate entry names before invoking file operations.
Attack Vector
Exploitation requires an attacker to deliver a crafted archive to a target user. The user must open or preview the archive in MantisZip for the vulnerable code path to execute. No authentication is required. The attack is remote in the sense that archives can be distributed via email, download links, or shared storage.
No verified exploit code is published here. Technical details are available in the referenced issue tracker.
Detection Methods for CVE-2026-96884
Indicators of Compromise
- Archive files (.zip and related formats) containing entry names with ..\, ../, or absolute path prefixes such as C:\.
- Unexpected file writes or reads performed by the MantisZip process outside the user's working directory.
- MantisZip process accessing sensitive system paths such as %APPDATA%, %TEMP%, or startup folders without user intent.
Detection Strategies
- Inspect archive contents before opening using tooling that lists entry names and flags traversal sequences.
- Monitor file system telemetry for the MantisZip process accessing paths outside its expected working directory.
- Correlate archive extraction events with subsequent writes to autostart or configuration locations.
Monitoring Recommendations
- Enable file integrity monitoring on user profile directories, startup folders, and system configuration paths.
- Log process execution and file access for MantisZip and alert on anomalous write destinations.
- Review download sources for archives destined for workstations running MantisZip.
How to Mitigate CVE-2026-96884
Immediate Actions Required
- Avoid opening untrusted archives in MantisZip versions 0.4.5 or earlier.
- Restrict MantisZip usage to isolated accounts or sandboxed environments until a patch is available.
- Validate archive entry names using a dedicated archive inspection tool before extraction.
Patch Information
No vendor patch is currently available. The maintainer was informed through an issue report on Gitee but has not responded. Monitor the MantisZip Gitee project for updates and track status at the VulDB vulnerability page.
Workarounds
- Use an alternative archive utility that enforces path containment during extraction and preview.
- Run MantisZip under a low-privilege account to limit the scope of arbitrary file access.
- Apply application allowlisting to prevent MantisZip from executing on systems that handle untrusted archives.
- Scan incoming archives with security tooling that detects path traversal entries before delivery to end users.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
