A path traversal vulnerability in MantisZip versions 0.4.5 and earlier enables unauthenticated remote attackers to manipulate file paths and potentially access sensitive system files.

The vulnerability is a path traversal flaw (CWE-22) located in the Path.Combine function within the MainWindow.UI.cs file of the Preview component. This flaw can be triggered remotely by an unauthenticated attacker.

Successful exploitation allows an attacker to traverse the file system, potentially leading to unauthorized disclosure of sensitive information or data compromise. While the CVSS score of 6.3 indicates a medium severity, the ability for remote execution without authentication poses a significant risk to the confidentiality and integrity of the hosting environment.

Immediate Action: As no official patch is currently available, users should restrict access to the affected software or disable the Preview component if it is not business-critical.

Proactive Monitoring: Monitor system and application logs for unusual file access patterns, especially attempts to access directories outside of the intended application scope.

Compensating Controls: Implement Web Application Firewall (WAF) rules designed to detect and block path traversal sequences, such as dot-dot-slash patterns, in incoming HTTP requests.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the linked issue report on Gitee.

Given that the vendor has not yet released a patch, organizations utilizing MantisZip should treat this vulnerability with high priority. We recommend isolating affected instances from external networks and implementing strict input validation or WAF filtering to prevent exploitation until an official update is provided by the project maintainers.