Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in the...

0.69

github-advisories · v1 · published 11/3/2026, 12:31:48 PM · modified 11/3/2026, 12:31:53 PM · TLP:CLEAR

offsec.vulnerability

Source evidence ↗

Entities

cwe: CWE-22ghsa: GHSA-8g37-89wr-9v3ccve: CVE-2026-89229

Assessment

Fact summary

low · heuristic

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in the ShareActivity component of BlueLM Copilot (com.vivo.ai.copilot) allows a malicious application installed on the same device to write arbitrary files via a crafted ACTION_SEND intent with a ContentProvider-supplied file name containing '..' sequences.

Technical delta

low · heuristic

Automated delta unavailable (heuristic mode).

Defensive significance

low · heuristic

None identified (heuristic mode).

Extracted text

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in the ShareActivity component of BlueLM Copilot (com.vivo.ai.copilot) allows a malicious application installed on the same device to write arbitrary files via a crafted ACTION_SEND intent with a ContentProvider-supplied file name containing '..' sequences.