CVE-2026-89038— Verizon Cloud for Android < 26.7.10 Path Traversal via OneTouchUploadActivity
Quick assessment
Affected
Verizon Verizon Cloud for Android
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Verizon Cloud for Android（com.vcast.mediamanager）在 26.7.10 版本之前存在一个路径遍历漏洞，允许同设备上的恶意应用程序通过向已导出的 OneTouchUploadActivity 和 PrintShopCloudActivity 活动提供包含路径遍历序列的构造好的 值，将攻击者控制的字节写入到指定暂存目录之外的位置。攻击者可以利用文件暂存汇聚点中未经过净化的文件名拼接，通过 或 意图实现任意文件写入，从而无需用户交互即可向已认证用户的 Verizon Clou
Possible ATT&CK Techniques 3 AI
T1059 · Command and Scripting Interpreter T1041 · Exfiltration Over C2 Channel T1566 · Phishing
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-89038
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Verizon Cloud for Android < 26.7.10 Path Traversal via OneTouchUploadActivity
Source: CVE Program / CVE List V5
Vulnerability Description
Verizon Cloud for Android (com.vcast.mediamanager) before 26.7.10 contains a path traversal vulnerability that allows co-resident malicious applications to write attacker-controlled bytes outside the intended staging directory by supplying a crafted _display_name value containing path-traversal sequences through exported activities OneTouchUploadActivity and PrintShopCloudActivity. Attackers can exploit the unsanitized filename concatenation in the file-staging sink via ACTION_SEND or ACTION_SEND_MULTIPLE intents to achieve arbitrary file write and inject attacker-controlled content into the authenticated user's Verizon Cloud account without user interaction.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Verizon | Verizon Cloud for Android | 0 ~ 26.7.10 | - |
|
II. Public POCs for CVE-2026-89038
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-89038
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-89038 (1)
Proof of Concept for CVE-2026-89038 (1)
-
🔗 GitHub - actuator/com.vcast.mediamanager: Verizon Cloud · GitHub Read full article technical-description exploit
Vendor Pages for CVE-2026-89038 (1)
IV. Related Vulnerabilities
Same weakness: CWE-22
-
CVE-2026-54617
GravitLauncher: Unauthenticated path traversal in LaunchServ -
CVE-2026-55062
uniget: Path Traversal in Hook Files - Directory Escape Vuln -
CVE-2026-54053
Many Notes: Path Traversal via ZIP import allows arbitrary f -
CVE-2026-54585
mport sample file handling can write outside the configured -
CVE-2026-54583
mport package bundle downloads allow unsafe destination file
V. Comments for CVE-2026-89038
No comments yet