CVE-2026-18907

HIGH

PathTravelsal Vulnerability in com.talpa.hibrowser

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2026-18907 has a selected CVSS score of 7.5 (high); EIP currently links 1 repository PoC.

Description

Path Traversal in Download File Feature in com.talpa.hibrowser 2.23.1.1 on Android allows arbitrary file write via directory traversal sequences in the filename.

Description source: CVE List

Exploitation context

Available material

Repository PoCs
1

CISA SSVC decision

ExploitationNone
AutomatableYes
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Aug 6, 2026 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

Hi Browser

Browse TECNO Mobile / Hi Browsercom.talpa.hibrowser

Default status: unaffected

CVE List2.23.1.1affected

Proofs of concept

1

Repository PoCs

GitHubHunt-Benito/two-dots-and-a-slash-cve-2026-18907-tecno-hi-browser-download-path-traversalRepository PoCby Hunt-Benito0Scanner4 files

13.9 KiB

GitHub
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact demonstrates the root cause of CVE-2026-18907 by serving a malicious HTTP response with a path-traversal filename and providing a client that reproduces the vulnerable join pattern. It does not exploit the actual TECNO Hi Browser APK; it validates the vulnerability class and shows how to detect the escape.

Backdoor review

No backdoor observed in reviewed code

The repository contains a proof-of-concept for CVE-2026-18907, a path-traversal vulnerability in TECNO Hi Browser. The three text files (README.md, evil_server.py, naive_downloader.py) demonstrate the delivery of a malicious HTTP response with '../' in the Content-Disposition filename and a naive downloader that reproduces the vulnerable path-join pattern. No backdoor, concealed executable behavior, or operator-directed harm is present. The code is transparent, well-documented, and serves only to illustrate the vulnerability and its fix.

ClassificationScanner
Model confidence95%
AuthenticationNot required
LanguagesPython
Target softwareTECNO Hi Browser
Attack typesPath Traversal
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact does not include or interact with the actual vulnerable TECNO Hi Browser APK. It provides a standalone server and a client that reproduces the vulnerable pattern to demonstrate and detect the path-traversal class, which is characteristic of a scanner.

README.md:18-21naive_downloader.py:3-9

Requirements

  • A vulnerable browser or download manager that trusts the Content-Disposition filename without sanitization.README.md:5-10
  • The malicious server (evil_server.py) must be reachable by the client.evil_server.py:17-18

Observed behavior

  • evil_server.py serves an HTTP response with a Content-Disposition header containing '../' sequences in the filename.evil_server.py:39-44
  • naive_downloader.py fetches the response, extracts the filename, and writes the body to a path constructed by joining the download directory with the unsanitized filename, causing the file to be written outside the intended directory.naive_downloader.py:52-54naive_downloader.py:97-101
  • The script reports whether the file escaped the download directory, confirming the vulnerability class.naive_downloader.py:101-104
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Payload
b"pwned by CVE-2026-18907 path-traversal PoC\n"The payload written by the PoC server is a benign marker string used to demonstrate the file-write primitive.evil_server.py:26
Network Behavior
HTTP server on 0.0.0.0:8000 serving a single response with a crafted Content-Disposition headerThe server is the delivery mechanism for the path-traversal payload; it does not establish persistence, exfiltrate data, or accept commands.evil_server.py:34-55
File Write
Writes a file to a path resolved from the crafted filenameThe naive_downloader.py script writes the payload to a path that may escape the download directory, demonstrating the vulnerability. This is the intended PoC behavior.naive_downloader.py:96-104
Review boundaries

What the analysis did not establish

  • The evidence does not include the proprietary com.talpa.hibrowser APK, so the artifact cannot demonstrate exploitation of the actual vulnerable application.
  • One file (LICENSE) is omitted from the text evidence, but it is unlikely to contain behavior-bearing code.
  • One file (LICENSE) was present in the repository metadata but not included as text; it is a standard license file and not executable.
  • The review is limited to the supplied text evidence; no dynamic analysis or execution was performed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

References

2