CVE-2026-109106
4.4 MEDIUMPublished 2026-10-13 · Updated 2026-10-15
AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.
NVD description
A security flaw has been discovered in Polaris Office App 9.9.19 on Android. Affected by this vulnerability is the function com.infraware.service.m.n.a of the component Document Intake. The manipulation of the argument _display_name results in path traversal. The attack is only possible with local access. The exploit has been released to the public and may be used for attacks. Upgrading to version 9.9.22 addresses this issue. It is recommended to upgrade the affected component. The vendor confirms: "We added path validation logic to ensure that files are created only within the designated temporary directory."
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Weaknesses
CWE-22
All references
- https://docs.google.com/document/d/1HtHrkT1NRX7ZY8uyu_C0F2Scp7wWDcor/edit?usp=sharing&ouid=100768766778062598194&rtpof=true&sd=true
- https://play.google.com/store/apps/details?id=com.infraware.office.link
- https://vuldb.com/cve/CVE-2026-109106
- https://vuldb.com/submit/886481
- https://vuldb.com/vuln/416857
- https://vuldb.com/vuln/416857/cti
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- HIGHCVE-2014-125130PoC
- HIGHCVE-2017-20284
- HIGHCVE-2021-48011PoC
- HIGHCVE-2023-54403PoC
- MEDIUMCVE-2024-58386PoC
- HIGHCVE-2024-58387PoC
- HIGHCVE-2024-58388PoC
- MEDIUMCVE-2025-1280
Related by shared AI tags and CWE weakness class. Browse the full archive.