CVE-2025-63371
📋 TL;DR
OneCommander 3.102.0.0 contains a directory traversal vulnerability in its ZIP file processing component that allows attackers to write files outside the intended extraction directory. This affects users who extract malicious ZIP archives with the vulnerable software. Attackers could potentially overwrite system files or plant malicious executables.
💻 Affected Systems
- Milos Paripovic OneCommander
📦 What is this software?
Onecommander by Onecommander
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise via overwriting critical system files or planting persistent malware with elevated privileges.
Likely Case
Local file system corruption, data loss, or installation of user-level malware through crafted ZIP archives.
If Mitigated
Limited impact if software runs with minimal privileges and file system permissions restrict write access to sensitive locations.
🎯 Exploit Status
Exploitation requires user to open a malicious ZIP file. No authentication bypass needed as user already has file access.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: UNKNOWN
Vendor Advisory: https://www.onecommander.com/
Restart Required: No
Instructions:
1. Check vendor website for security updates. 2. If patch available, download and install updated version. 3. Verify version number after installation.
🔧 Temporary Workarounds
Disable ZIP extraction in OneCommander
windowsConfigure OneCommander to not handle ZIP files or use alternative ZIP extraction software
Run with restricted privileges
windowsRun OneCommander with standard user privileges (not administrator) to limit file system damage
🧯 If You Can't Patch
- Educate users to avoid opening ZIP files from untrusted sources with OneCommander
- Implement application whitelisting to prevent execution of unauthorized files that could be planted via this vulnerability
🔍 How to Verify
Check if Vulnerable:
Check OneCommander version in Help > About. If version is 3.102.0.0 or potentially earlier, system is vulnerable.Check Version:
Check via OneCommander GUI: Help > AboutVerify Fix Applied:
After updating, verify version number is higher than 3.102.0.0 and test with known safe ZIP extraction.📡 Detection & Monitoring
Log Indicators:
- Unusual file write operations outside expected extraction directories
- OneCommander process accessing system directories
Network Indicators:
- No direct network indicators as this is local file processing
SIEM Query:
Process:OneCommander.exe AND (FileWrite:*\..\* OR FileWrite:*\windows\* OR FileWrite:*\program files\*)