CVE-2025-48567
HIGHCVSS Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
2Description
In multiple locations, there is a possible bypass of a file path filter designed to prevent access to sensitive directories due to incorrect unicode normalization. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.
Analysis
In multiple locations, there is a possible bypass of a file path filter designed to prevent access to sensitive directories due to incorrect unicode normalization. This could lead to local escalation of privilege with no additional execution privileges needed. [CVSS 7.8 HIGH]
Technical Context
Classified as CWE-22 (Path Traversal). Affects Android. In multiple locations, there is a possible bypass of a file path filter designed to prevent access to sensitive directories due to incorrect unicode normalization. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.
Affected Products
Vendor: Google. Product: Android. Versions: up to 14.0.
Remediation
Monitor vendor advisories for a patch. Validate and sanitize file path inputs. Use allowlists.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today