CVE-2026-89229: Path Traversal
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in the ShareActivity component of BlueLM Copilot (com.vivo.ai.copilot) allows a malicious application installed on the same device to write arbitrary files via a crafted ACTIONSEND intent with a ContentProvider-supplied file name containing '..' sequences.
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Devices that have the BlueLM Copilot application installed are exposed to malicious applications running on the same device. The attack vector is local, so it is not described as remotely exploitable over a network.
What does an attacker need to exploit the issue?
An attacker needs to get a malicious application installed and running on the target device. The provided vector indicates no privileges or user interaction are required, and exploitation uses a crafted ACTION_SEND intent with a ContentProvider-controlled filename.
What is the likely impact of successful exploitation?
A malicious local application can write arbitrary files by using filename values containing '..' path traversal sequences. The supplied severity vector rates integrity and availability impact as low, with no confidentiality impact indicated.