muCommander through version 1.6.2 contains a path traversal flaw in its archive extraction component, UnpackJob. The flaw allows an attacker to craft archive entries such as ../../.ssh/authorized_keys that bypass the application’s normal ZipSlip check. When these entries are extracted to FTP or SFTP destination folders, the files are created or overwritten in locations outside the intended directory, giving the attacker the ability to modify essential configuration files on the remote server. The vulnerability can thus lead to credential compromise or other forms of destructive modification of user files.

The affected product is muCommander, versions up to and including 1.6.2. Any installation of muCommander that uses the UnpackJob for archive extraction to FTP or SFTP services is potentially vulnerable.

The CVSS score of 5.6 indicates a moderate severity impact. No EPSS score is available, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector involves an adversary who can supply or trigger the extraction of a malicious archive through the FTP or SFTP interface. If the attacker has write permission to the target FTP/SFTP location, the path traversal bypass allows them to overwrite files such as .ssh/authorized_keys, which can elevate their access or facilitate further compromise. The vulnerability does not appear to require authentication beyond the normal permissions for writing to the remote service, making it relatively easy to abuse in environments with permissive file upload or archive extraction capabilities.