CVE-2026-89038 Verizon Cloud for Android < 26.7.10 Path Traversal via OneTouchUploadActivity
Malicious apps can write arbitrary files to the user's Verizon Cloud account via path traversal in exported activities, potentially injecting content without user interaction.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-89038?
CVE-2026-89038 is a medium-severity path traversal vulnerability in Verizon Cloud for Android, published on 17 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Verizon Cloud for Android (com.vcast.mediamanager) before 26.7.10 contains a path traversal vulnerability that allows co-resident malicious applications to write attacker-controlled bytes outside the intended staging directory by supplying a crafted _display_name value containing path-traversal sequences through exported activities OneTouchUploadActivity and PrintShopCloudActivity. Attackers can exploit the unsanitized filename concatenation in the file-staging sink via ACTION_SEND or ACTION_SEND_MULTIPLE intents to achieve arbitrary file write and inject attacker-controlled content into the authenticated user's Verizon Cloud account without user interaction.
Weakness: CWE-22
Which versions are affected by CVE-2026-89038?
How do I fix CVE-2026-89038?
No fix has been published for CVE-2026-89038 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-89038 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-89038 exists.
Sources
Also known as GHSA-x3gc-cx3q-fw5m.