CVE-2026-84431 AirAsia MOVE App com.airasia.mobile com.airasia.core.utils.RealPathUtil.getRealPath path traversal
A local attacker can exploit a path traversal vulnerability in the AirAsia MOVE Android app to read or modify arbitrary files via the getRealPath function.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-84431?
CVE-2026-84431 is a medium-severity path traversal vulnerability in AirAsia MOVE App, published on 2 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A vulnerability was detected in AirAsia MOVE App up to 12.47.1 on Android. This issue affects the function com.airasia.core.utils.RealPathUtil.getRealPath of the component com.airasia.mobile. Performing a manipulation of the argument _display_name results in path traversal. The attack requires a local approach. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Weakness: CWE-22
Which versions are affected by CVE-2026-84431?
How do I fix CVE-2026-84431?
No fix has been published for CVE-2026-84431 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-84431 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-84431 exists.
Sources
Also known as GHSA-m335-63m5-3fhm.