CVE-2026-109106: Polaris Office App Document Intake com.infraware.service.m.n.a path traversal
A security flaw has been discovered in Polaris Office App 9.9.19 on Android. Affected by this vulnerability is the function com.infraware.service.m.n.a of the component Document Intake. The manipulation of the argument displayname results in path traversal. The attack is only possible with local access. The exploit has been released to the public and may be used for attacks. Upgrading to version 9.9.22 addresses this issue. It is recommended to upgrade the affected component. The vendor confirms: "We added path validation logic to ensure that files are created only within the designated temporary directory."
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Polaris Office App for Androidto a version that resolves this vulnerability.Fixed in 9.9.22
Event History
Frequently Asked Questions
Who can exploit this issue?
Exploitation requires local access to an affected Android device and low-level privileges. It does not require user interaction.
What attacker-controlled input triggers the vulnerability?
The vulnerable Document Intake function uses the _display_name argument in a way that permits path traversal. An attacker able to manipulate this argument may cause files to be created outside the designated temporary directory.
Is public exploit code available?
Yes. The exploit has been released publicly and may be used in attacks.
What version fixes the issue?
Upgrade Polaris Office App to version 9.9.22. The vendor states that this release adds path validation so files are created only within the designated temporary directory.