Fossify File Manager through 1.6.2 contains a path traversal flaw in the DecompressActivity that allows an attacker to craft ZIP entries with sequences such as ../<name>_x/file to cause files to be written outside the intended extraction directory. This flaw bypasses an unanchored startsWith check, giving the attacker the ability to create or overwrite files in sibling or parent folders, potentially leading to unauthorized file writes or overwriting critical data. The weakness is classified as CWE-22.

The vulnerability affects Fossify File Manager version 1.6.2 and earlier, specifically when using the DecompressActivity to extract ZIP archives. No other products are listed as impacted.

The CVSS score of 4.6 indicates a moderate impact; the EPSS score is not available and the issue is not listed in the CISA KEV catalog. The likely attack vector is local or remote injection of a crafted archive, inferred because the flaw arises when a user extracts a ZIP file. An attacker who can supply or influence a ZIP archive processed by the app can exploit this to write arbitrary files outside the target folder. No public exploit is documented, but the condition is present in all affected releases.