CVE-2026-109106

4.4Medium

Published 13 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

4.4Medium

Attack vector: Local
Complexity: Low
Privileges needed: Low
User interaction: None
Impact: Limited impact
Weakness: CWE-22

Impact

A local attacker or malicious app can write files outside intended directories to modify app data or cause denial of service. They require local device access and low-privilege execution.

Root cause

The Document Intake component fails to sanitize the '_display_name' argument before creating files, permitting path traversal.

Affected systems

Polaris Office App for Android version 9.9.19 (prior to 9.9.22).

CVSS v3.1 · CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Fix & remediation

Upgrade Polaris Office on Android to version 9.9.22 or later via the Google Play Store; no interim workaround is provided.

shell

$ adb shell dumpsys package com.infraware.office.link | grep -i versionName

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

A security flaw has been discovered in Polaris Office App 9.9.19 on Android. Affected by this vulnerability is the function com.infraware.service.m.n.a of the component Document Intake. The manipulation of the argument _display_name results in path traversal. The attack is only possible with local access. The exploit has been released to the public and may be used for attacks. Upgrading to version 9.9.22 addresses this issue. It is recommended to upgrade the affected component. The vendor confirms: "We added path validation logic to ensure that files are created only within the designated temporary directory."

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-109106