| Title | Polaris Office Corp https://play.google.com/store/apps/details?id=com.infraware.office.link 9.9.19 Path Traversal |
|---|
| Description | Polaris Office for Android is affected by a path traversal vulnerability in its document intake path. The launcher activity com.infraware.service.ActLauncher is exported and declares an intent filter that accepts content and file URIs of any MIME type under the VIEW, EDIT, PICK, RUN and SEARCH actions, so it can be invoked by any other application on the device. When such an intent is processed, the routine com.infraware.service.m.n.a(android.content.Intent) reads the file name from the sending ContentProvider by querying the _display_name column (or a filename column) and concatenates that value, without sanitization, onto a fixed base directory under the application's external storage, then copies the sender's input stream to the resulting file. The file name is never reduced to its base component and no canonical containment check is applied, so a _display_name containing ../ sequences traverses out of the intended directory. A malicious application can thereby write fully attacker-controlled content to an attacker-chosen path inside the Polaris external storage tree, including the application's own app-specific external directory that the document viewer subsequently reads and trusts. Exploitation requires only local inter-process access and needs no user interaction and no additional permissions. This was confirmed on-device: an unprivileged application exporting a ContentProvider that returns a traversal string as _display_name causes a marker file to be written under the Polaris process UID, outside the intended cache directory. |
|---|
| Source | ⚠️ https://docs.google.com/document/d/1HtHrkT1NRX7ZY8uyu_C0F2Scp7wWDcor/edit?usp=sharing&ouid=100768766778062598194&rtpof=true&sd=true |
|---|
| User | Actuator (UID 67941) |
|---|
| Submission | 07/11/2026 16:56 (4 months ago) |
|---|
| Moderation | 10/12/2026 10:21 (3 months later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 416857 [Polaris Office App 9.9.19 on Android Document Intake com.infraware.service.m.n.a _display_name path traversal] |
|---|
| Points | 20 |
|---|