MP Manager versions up to 1.1.0 include a path traversal flaw that lets an attacker craft archive entries such as ....//file. When the application extracts the archive, the sanitizeEntryName routine does not fully collapse the path, allowing the entry to become ../file. The attacker can therefore write files outside the intended extraction directory, creating or overwriting any file the application can write on shared storage. This capability can be leveraged to place malicious code or modify critical configuration files, potentially leading to unauthorized code execution or data tampering.

Abdurazaaq Mohammed’s MP Manager product, with the issue present in all releases up through version 1.1.0. Users running any of these versions are susceptible; the vulnerability does not affect later releases as they patch the extraction routine.

The CVSS score of 6.7 indicates moderate severity, and the EPSS score is currently unavailable, though the flaw is not listed in the CISA KEV catalog. Exploitation requires that the attacker can supply a crafted archive to the app or otherwise influence the extraction process. If the MP Manager service runs with elevated privileges or writes to a broadly accessible shared storage area, the damage potential rises to high, enabling arbitrary file placement and possible remote code execution. In environments where shared storage is protected, the risk is lower but still significant enough to warrant immediate attention.