PT-2025-47535 · Unknown · Onecommander

Published 2025-11-19 · Updated 2025-11-22 · CVE-2025-63371

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions OneCommander version 3.102.0.0

Description OneCommander version 3.102.0.0 contains a flaw in the ZIP file processing component. This issue relates to how the software handles ZIP archive contents during extraction, potentially allowing for directory traversal. The vulnerability exists in the functionality responsible for extracting and handling ZIP archive contents.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2025-63371

Affected Products

Onecommander

References · 8

• https://osv.dev/vulnerability/CVE-2025-63371 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-63371 · Security Note
• https://twitter.com/SecAideInfo/status/1992174799787827498 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1991335274035458344 · Twitter Post
• https://jeroscope.com/advisories/2025/jero-2025-007 · Note
• https://twitter.com/CVEnew/status/1991409501782593625 · Twitter Post
• https://t.me/CVEtracker/37792 · Telegram Post
• https://onecommander.com · Note