What is the CVSS score of CVE-2025-68713?

CVE-2025-68713 has a CVSS 3.1 base score of 8.0 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Send Anywhere are affected by CVE-2025-68713?

Rakuten Send Anywhere Android users running version 23.2.9 face a critical code execution risk if a second malicious app is installed on their device, potentially enabling data theft or device…

How to fix or mitigate CVE-2025-68713?

Within 24 hours, identify and notify users running Send Anywhere version 23.2.9 and advise immediate uninstallation or upgrade if available; block the app from enterprise-managed devices via mobile device management. Within 7 days, monitor Rakuten's security advisories and GitHub repository for patch releases, and identify alternative file-transfer solutions for business use. Within 30 days, deploy the vendor-released patch to all users once available, or migrate to a replacement application if no patch is released within an acceptable timeframe.

Send Anywhere CVE-2025-68713

EUVD-2025-210155 HIGH

Improper Export of Android Application Components (CWE-926)

2026-06-15 mitre

GHSA-5jv9-6p43-2v8w

Denial Of Service RCE Google N A

8.0

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

8.0 HIGH

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

7.1 HIGH

A co-installed, permission-less app triggers an exported component (AV:L/PR:N); reliable impacts are file injection (I:H) and resource-exhaustion DoS (A:H), while confidentiality and RCE hinge on the user installing the APK (UI:R).

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 16:55 vuln.today

CVE Published

Jun 15, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 15, 2026 - 00:00 cve.org

HIGH 8.0

DescriptionCVE.org

An issue was discovered in Rakuten Send Anywhere (File Transfer) for Android (com.estmob.android.sendanywhere) 23.2.9. The vulnerability allows untrusted applications (with no permissions) to force arbitrary file downloads into the app's scoped storage. The resulting files appear in the application's trusted Received interface. These conditions establish a vector for arbitrary code execution if the payload is an APK file, or a denial-of-service condition through resource exhaustion from oversized transfers.

AnalysisAI

Unauthorized file injection in Rakuten Send Anywhere (File Transfer) for Android version 23.2.9 (com.estmob.android.sendanywhere) lets any co-installed app that holds no permissions force the client to pull arbitrary files into its scoped storage, where they surface inside the app's trusted 'Received' list. Because a delivered APK sitting in that trusted interface invites the user to install it, this creates an arbitrary-code-execution path, and oversized transfers create a denial-of-service (storage/resource exhaustion) condition. No public exploit identified at time of analysis; the issue is documented in a researcher advisory on GitHub, EPSS is low (0.17%, 6th percentile), and it is not listed in CISA KEV.

Technical ContextAI

The flaw maps to CWE-926 (Improper Export of Android Application Components). Send Anywhere is a consumer file-transfer client that exchanges files between devices; the root cause is an Android component (activity, service, receiver, or content provider / deep-link handler) that is exported or otherwise reachable by other locally installed apps without an adequate permission or origin check. A malicious app declaring no permissions can invoke this surface to instruct Send Anywhere to fetch and persist files into its own scoped storage. Those files are then rendered in the app's 'Received' UI, which users treat as legitimate transfers they initiated, laundering attacker-controlled content through a trusted interface. The CPE data supplied (cpe:2.3:a:n/a:n/a:*) is a placeholder and identifies nothing useful; the concrete affected product is the Android package com.estmob.android.sendanywhere at 23.2.9.

RemediationAI

No vendor-released patch or fixed version is identified in the available data, so a specific upgrade target cannot be cited; monitor the Google Play listing for com.estmob.android.sendanywhere and update to any release newer than 23.2.9 that references this issue, and consult the researcher writeup at https://github.com/actuator/com.estmob.android.sendanywhere/blob/main/CVE-2025-68713 and https://nvd.nist.gov/vuln/detail/CVE-2025-68713 for status. As compensating controls until a fix ships: on managed devices, restrict or uninstall the app via MDM if it is not business-critical (trade-off: loss of the transfer feature); ensure 'Install unknown apps' / unknown-sources installation is disabled for Send Anywhere and the device broadly, which breaks the APK-to-RCE step (trade-off: none for most users); educate users to treat unexpected entries in the 'Received' list as untrusted and never install APKs from it (trade-off: relies on user diligence); and use Google Play Protect to catch injected malicious APKs. These reduce the exploit's practical impact but do not close the underlying exported-component exposure.