CVE-2026-89038

Overview

Verizon Cloud for Android before version 26.7.10 contains a path traversal vulnerability in its exported activities. Co-resident malicious applications can exploit this flaw using crafted intents to write files outside the intended staging directory. This allows unauthorized injection of content into the authenticated user's cloud account without requiring user interaction.

Description

Verizon Cloud for Android (com.vcast.mediamanager) before 26.7.10 contains a path traversal vulnerability that allows co-resident malicious applications to write attacker-controlled bytes outside the intended staging directory by supplying a crafted _display_name value containing path-traversal sequences through exported activities OneTouchUploadActivity and PrintShopCloudActivity. Attackers can exploit the unsanitized filename concatenation in the file-staging sink via ACTION_SEND or ACTION_SEND_MULTIPLE intents to achieve arbitrary file write and inject attacker-controlled content into the authenticated user's Verizon Cloud account without user interaction.

Impact

This vulnerability primarily impacts the integrity of user data within the Verizon Cloud account, with potential implications for data confidentiality if sensitive files are overwritten. Any authenticated user of the vulnerable mobile application is at risk if they have malicious apps co-resident on the same device. The issue stems from unsanitized filename concatenation when processing incoming intents.

Remediation

Upgrade Verizon Cloud for Android to version 26.7.10 or later where input sanitization for filenames is properly implemented. Restrict or properly protect exported components (OneTouchUploadActivity and PrintShopCloudActivity) to prevent unauthorized intent processing from untrusted applications.

Risk context

The vulnerability is rated as medium severity with a CVSS v3 score of 6.2 and a CVSS v4 score of 6.9. While EPSS data is not currently available, remediation should be prioritized as part of standard mobile application update cycles to prevent unauthorized data modification.

Affected products

• Verizon Cloud for Android < 26.7.10