CVE-2018-8909

HIGH

Wire < 2018-03-07 - Path Traversal via Filename with ../ Sequence

Title source: llm
STIX 2.1

Description

The Wire application before 2018-03-07 for Android allows attackers to write to pathnames outside of the downloads directory via a ../ in a filename of a received file, related to AssetService.scala.

References (1)

Core 1
Core References

Scores

CVSS v3 7.5
EPSS 0.0195
EPSS Percentile 77.8%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Details

CWE
CWE-22
Status published
Products (1)
wire/wire < 2018-03-07
Published Mar 22, 2018
Tracked Since Feb 18, 2026