The flaw is located in the Path.Combine call within MainWindow.UI.cs of the Preview component, where improperly validated input can result in a path traversal condition. This allows a remote attacker to construct a preview request that references files outside the intended directory structure; while the CVE description does not specify the exact consequences, a traversal vulnerability could enable reading, modifying, or otherwise interacting with unintended filesystem locations. The attack vector relies on manipulation of the preview path parameter and can be against any MantisZip instance that exposes the preview functionality.

MantisZip versions 0.4.5 and earlier are affected, including the 0.4.5 release. No later release has been documented as containing a fix, and the project has not yet responded to the vulnerability report. The vulnerability applies to all builds that ship the unpatched Preview component, regardless of deployment scenario, whether on Windows desktop or local servers using MantisZip for archive handling.

The CVSS score of 5.3 places the vulnerability in the moderate risk range, and the exploit is publicly available, giving attackers a realistic chance to leverage the flaw. No EPSS score is published, and the vulnerability is not listed in the CISA KEV catalog, but the absence of a vendor fix and the remote nature of the attack make it a tangible risk for exposed deployments. Unmitigated, a path traversal flaw can facilitate further attacks by allowing attackers to read sensitive configuration files or to execute arbitrary code via file replacement, depending on the target system's permissions.