EUVD-2025-210155
GHSA-5jv9-6p43-2v8w
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessInstall unprivileged malicious app on device
-
DeliveryInvoke Send Anywhere exported component via IPC
-
ExploitForce download of attacker APK to scoped storage
-
ExecutionFile appears in trusted 'Received' list
-
PersistUser opens and installs the APK
-
ImpactArbitrary code execution (or storage-exhaustion DoS)
Vulnerability Assessment
| Weakness |
CWE
|
| Exploitation Conditions | Exploitation requires a second, attacker-controlled Android application already installed on the same device; that app needs no declared permissions but must be able to reach Send Anywhere's exported/unprotected component to trigger the file download. Full arbitrary code execution additionally requires the victim to open the injected APK from the 'Received' list and complete installation, which presupposes 'install from unknown sources' being permitted - significant user interaction (UI:R) that materially limits the RCE outcome. The denial-of-service variant needs only the ability to force oversized transfers and no user install step. The confirmed-vulnerable configuration is Send Anywhere 23.2.9 on Android; other versions are unverified. |
| Impact | The signals conflict and net out to moderate real-world risk. NVD assigns CVSS 8.0 with AV:N, but the described mechanism is a locally co-resident malicious app abusing an exported component - that is a local/IPC attack surface (AV:L in practice), so the network vector overstates reachability; verify with the vendor. SSVC rates Exploitation 'none' and Automatable 'no' while Technical Impact is 'total', and EPSS is very low (0.17%, 6th percentile), all consistent with a not-actively-exploited, non-wormable issue. The headline RCE outcome is not automatic: the payload only executes if the user opens the injected APK and completes an install (UI:R, plus 'install from unknown sources'), so the reliable, low-friction impacts are integrity (unwanted files planted in a trusted view, enabling social-engineering) and availability (DoS via oversized transfers). Treat this as a meaningful mobile-app hardening bug rather than an urgent internet-facing emergency. |
| Exploit ScenarioDerived | A user installs an innocuous-looking app that quietly requests no permissions; in the background it invokes Send Anywhere's exposed component to download a malicious APK into the app's storage. The file appears in the victim's trusted 'Received' interface as though it were a legitimate transfer, and when the user taps to open it and approves installation, the attacker gains code execution - or, in a lighter variant, the same channel pushes multi-gigabyte files to exhaust device storage. A technical advisory documenting the behavior is published on GitHub, but no weaponized public exploit is confirmed. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 23, 2026
Unauthorized file injection in Rakuten Send Anywhere (File Transfer) for Android version 23.2.9 (com.estmob.android.sendanywhere) lets any co-installed app that holds no permissions force the client to pull arbitrary files into its scoped storage, where they surface inside the app's trusted 'Received' list. Because a delivered APK sitting in that trusted interface invites the user to install it, this creates an arbitrary-code-execution path, and oversized transfers create a denial-of-service (storage/resource exhaustion) condition. No public exploit identified at time of analysis; the issue is documented in a researcher advisory on GitHub, EPSS is low (0.17%, 6th percentile), and it is not listed in CISA KEV.
RemediationAI
No vendor-released patch or fixed version is identified in the available data, so a specific upgrade target cannot be cited; monitor the Google Play listing for com.estmob.android.sendanywhere and update to any release newer than 23.2.9 that references this issue, and consult the researcher writeup at https://github.com/actuator/com.estmob.android.sendanywhere/blob/main/CVE-2025-68713 and https://nvd.nist.gov/vuln/detail/CVE-2025-68713 for status. As compensating controls until a fix ships: on managed devices, restrict or uninstall the app via MDM if it is not business-critical (trade-off: loss of the transfer feature); ensure 'Install unknown apps' / unknown-sources installation is disabled for Send Anywhere and the device broadly, which breaks the APK-to-RCE step (trade-off: none for most users); educate users to treat unexpected entries in the 'Received' list as untrusted and never install APKs from it (trade-off: relies on user diligence); and use Google Play Protect to catch injected malicious APKs. These reduce the exploit's practical impact but do not close the underlying exported-component exposure.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw maps to CWE-926 (Improper Export of Android Application Components). Send Anywhere is a consumer file-transfer client that exchanges files between devices; the root cause is an Android component (activity, service, receiver, or content provider / deep-link handler) that is exported or otherwise reachable by other locally installed apps without an adequate permission or origin check. A malicious app declaring no permissions can invoke this surface to instruct Send Anywhere to fetch and persist files into its own scoped storage. Those files are then rendered in the app's 'Received' UI, which users treat as legitimate transfers they initiated, laundering attacker-controlled content through a trusted interface. The CPE data supplied (cpe:2.3:a:n/a:n/a:*) is a placeholder and identifies nothing useful; the concrete affected product is the Android package com.estmob.android.sendanywhere at 23.2.9.
Know when N A gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
A co-installed, permission-less app triggers an exported component (AV:L/PR:N); reliable impacts are file injection (I:H) and resource-exhaustion DoS (A:H), while confidentiality and RCE hinge on the user installing the APK (UI:R).
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
2DescriptionCVE.org
An issue was discovered in Rakuten Send Anywhere (File Transfer) for Android (com.estmob.android.sendanywhere) 23.2.9. The vulnerability allows untrusted applications (with no permissions) to force arbitrary file downloads into the app's scoped storage. The resulting files appear in the application's trusted Received interface. These conditions establish a vector for arbitrary code execution if the payload is an APK file, or a denial-of-service condition through resource exhaustion from oversized transfers.
Executive ViewAI
Rakuten Send Anywhere Android users running version 23.2.9 face a critical code execution risk if a second malicious app is installed on their device, potentially enabling data theft or device takeover without user awareness. This exposes both personal and enterprise data to compromise.
No vendor-released patch identified at time of analysis. Interim mitigations include: restrict app installation to official app stores only; enable mobile threat defense to detect co-installed malware; disable sideloading on managed devices via MDM; enforce device-level security scanning; consider restricting app use to personally-owned devices where users maintain active security monitoring.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Exploit-DB