CVE-2026-89038: Verizon Cloud for Android < 26.7.10 Path Traversal via OneTouchUploadActivity
Verizon Cloud for Android (com.vcast.mediamanager) before 26.7.10 contains a path traversal vulnerability that allows co-resident malicious applications to write attacker-controlled bytes outside the intended staging directory by supplying a crafted displayname value containing path-traversal sequences through exported activities OneTouchUploadActivity and PrintShopCloudActivity. Attackers can exploit the unsanitized filename concatenation in the file-staging sink via ACTIONSEND or ACTIONSENDMULTIPLE intents to achieve arbitrary file write and inject attacker-controlled content into the authenticated user's Verizon Cloud account without user interaction.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
A malicious application installed on the same Android device can exploit the exported OneTouchUploadActivity or PrintShopCloudActivity. The attack does not require privileges or user interaction.
What input and access are required for exploitation?
The attacker needs to send an ACTION_SEND or ACTION_SEND_MULTIPLE intent with a crafted _display_name containing path-traversal sequences. The vulnerable app then uses the unsanitized filename while staging the supplied content.
Are users of the affected app exposed by default?
The affected activities are exported, allowing other co-resident applications to invoke them. Exploitation can result in writes outside the intended staging directory and attacker-controlled content being injected into the authenticated user's Verizon Cloud account.
What versions are affected?
Verizon Cloud for Android versions before 26.7.10 are affected. Updating to version 26.7.10 or later addresses the stated affected-version range.