CVE-2026-84431 in MOVE App
Summary
by MITRE • 09/02/2026
A vulnerability was detected in AirAsia MOVE App up to 12.47.1 on Android. This issue affects the function com.airasia.core.utils.RealPathUtil.getRealPath of the component com.airasia.mobile. Performing a manipulation of the argument _display_name results in path traversal. The attack requires a local approach. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/02/2026
The AirAsia MOVE application, specifically versions up to 12.47.1 on the Android platform, contains a critical path traversal vulnerability within its core utility functions. This security flaw resides in the com.airasia.core.utils.RealPathUtil.getRealPath method, which is responsible for resolving file paths from content URIs or other input sources into absolute filesystem paths. The function fails to adequately sanitize or validate user-supplied arguments before processing them, creating a classic opportunity for path traversal attacks. Specifically, by manipulating the _display_name argument passed to this component, an attacker can inject directory traversal sequences such as dot-dot-slash characters that allow navigation outside of the intended application sandbox boundaries.
This vulnerability is classified under CWE-22: Improper Limitation of a Pathname to a Restricted Directory, which describes situations where software does not properly neutralize special elements within a file path so that it affects the decision-making process for restricted directories. In the context of Android applications, this flaw undermines the fundamental security model known as sandboxing, which isolates application data from other apps and system processes. When an attacker successfully exploits this weakness, they can read or write files located in arbitrary locations on the device's storage that are accessible to the app's user ID but were not intended for access by the MOVE application itself. This could include sensitive personal information stored by other applications, cached credentials, or internal configuration files belonging to the system or other installed apps.
The operational impact of this vulnerability is significant because it enables local privilege escalation within the context of the compromised device and app instance. Since the exploit requires a local approach, an attacker must have physical access to the victim's Android device or control over another application running on that same device with sufficient permissions to trigger the vulnerable function. Once triggered, the malicious actor can exfiltrate sensitive data such as login tokens, personal identification details, travel itineraries, and payment information stored locally by the AirAsia MOVE app or other co-located applications. The fact that the exploit code is now public increases the risk landscape considerably, allowing less sophisticated threat actors to leverage existing tools for unauthorized access rather than developing custom exploits from scratch.
From a tactical perspective, this vulnerability aligns with ATT&CK technique T1552.004: Unsecured Credentials: Private Keys, if sensitive keys are stored in accessible directories, or more broadly under data exfiltration techniques that involve accessing local file systems without proper authorization controls. The lack of input validation on the _display_name parameter represents a failure to implement secure coding practices regarding resource management and access control. Although the vendor was contacted early regarding this disclosure, their non-response indicates potential gaps in their vulnerability response lifecycle or security communication protocols, leaving users exposed until an official patch is released through standard update channels.
Mitigation strategies for this issue involve both immediate defensive measures by end-users and long-term remediation steps for developers. Users should ensure they are running the latest version of the AirAsia MOVE app where possible, although given the vendor's lack of response, manual verification of updates may be necessary. Security professionals managing enterprise deployments or high-risk environments should consider restricting application permissions to minimize the attack surface related to file system access. For developers, remediation requires implementing strict input validation on all parameters passed to path resolution functions like getRealPath. This includes canonicalizing paths and verifying that the resulting absolute path remains within an expected base directory before proceeding with any file operations. Additionally, adopting static application security testing tools during development can help identify such path traversal flaws early in the software development lifecycle, preventing them from reaching production environments where they pose a direct risk to user data integrity and confidentiality.