| शीर्षक | LIPPU TECHNOLOGY Docx Reader - Office Viewer APP (https://play.google.com/store/apps/details?id=word.office.docxviewer.document.docx.reader) <=1.4.5 Path Traversal |
|---|
| विवरण | Description of the vulnerability for use in the CVE：An arbitrary file overwrite vulnerability in the Docx Reader - Office Viewer app allows attackers to overwrite critical internal files via the file import process.
Vulnerability Component：word.office.docxviewer.document.docx.reader.ViewTxt
Additional information：This vulnerability is caused by insufficient security validation when handling imported files. The vulnerable component trusts the _display_name value returned by a ContentProvider and uses it when constructing the destination path for an imported file. A malicious app can control the filename and content and use path traversal to overwrite sensitive files in the app’s internal storage. When critical configuration or executable files are modified, the app may malfunction, fail to launch, or execute arbitrary code.
The attack requires no complex user interaction and can be triggered automatically once the victim opens the malicious app. |
|---|
| स्रोत | ⚠️ https://github.com/Secsys-FDU/AF_CVEs/issues/31 |
|---|
| उपयोगकर्ता | Secsys-FDU (UID 93274) |
|---|
| सबमिशन | 31/08/2026 01:48 PM (1 महीना पहले) |
|---|
| संयम | 10/10/2026 03:48 PM (1 month later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 416199 [Lippu Docx Reader Office Viewer App तक 1.4.5 पर Android _display_name निर्देशिका ट्रैवर्सल] |
|---|
| अंक | 20 |
|---|