CVE-2026-18907 in Hi Browser
Summary
by MITRE • 08/05/2026
Path Traversal in Download File Feature in com.talpa.hibrowser 2.23.1.1 on Android allows arbitrary file write via directory traversal sequences in the filename.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/05/2026
The vulnerability identified in com.talpa.hibrowser version 2.23.1.1 represents a critical path traversal flaw within the application's download file feature that enables malicious actors to write files to arbitrary locations on the device filesystem. This weakness stems from insufficient input validation and sanitization of filenames provided during the download process, allowing attackers to manipulate directory traversal sequences such as ../ or ..\ to navigate outside the intended download directory. The vulnerability directly maps to CWE-22 - Improper Limitation of a Pathname to a Restricted Directory, which is classified as a high-severity issue in the Common Weakness Enumeration catalog and falls under the broader category of path traversal attacks that have been consistently documented in cybersecurity threat intelligence reports.
The technical implementation of this flaw occurs when the application processes user-provided filenames without proper sanitization or validation mechanisms. When a user initiates a download with a malicious filename containing directory traversal sequences, the application fails to properly resolve the target path, instead allowing the traversal to occur and write files to locations outside the intended download directory. This creates a significant attack surface where adversaries can potentially overwrite critical system files, inject malicious code into the application's execution path, or create persistent backdoors on the device. The vulnerability is particularly dangerous in mobile environments where applications often have elevated privileges and access to sensitive user data.
The operational impact of this vulnerability extends beyond simple unauthorized file creation, as it provides attackers with a potential foothold for more sophisticated attacks within the Android environment. An attacker could leverage this flaw to overwrite application configuration files, inject malicious payloads into the browser's execution context, or even target system-level components that may be vulnerable to privilege escalation. The attack vector is particularly concerning because it requires minimal user interaction beyond initiating a download process, making it suitable for automated exploitation campaigns. This vulnerability aligns with ATT&CK technique T1059 - Command and Scripting Interpreter and T1074 - Data Staged, as it enables both code execution and data manipulation capabilities within the target device.
Mitigation strategies should include implementing robust input validation that strips or rejects directory traversal sequences from filenames before processing them during download operations. The application must enforce strict path resolution mechanisms that prevent any form of relative path navigation outside the designated download directory boundaries. Additionally, developers should implement proper file access controls and ensure that downloaded files are stored in secure, isolated directories with appropriate permissions. Security patches should be deployed immediately to address this vulnerability, as the flaw represents a critical risk to user data integrity and device security. Organizations should also consider implementing runtime monitoring for suspicious file creation patterns and establish proper code review processes to identify similar vulnerabilities in other components of the application. The fix should adhere to secure coding practices outlined in OWASP Secure Coding Practices and follow Android security guidelines for file system access controls to prevent future occurrences of this class of vulnerability.