Lippu Docx Reader CVE-2026-108544

Exploitation requires the victim to open attacker-controlled content in the Lippu Docx Reader / Office Viewer app (versions up to 1.4.5 on Android), where the '_display_name' argument passed to the word.office.docxviewer.document.docx.reader.ViewTxt function is not sanitized, allowing '../' style path traversal. The key limiting factors are: mandatory passive user interaction (UI:P) - the attacker cannot trigger it without the user opening the malicious file; impact is confined to the Android app's sandbox (no scope change, SC/SI/SA:N); and it affects only this specific niche app at or below version 1.4.5. There is no evidence of a non-default configuration requirement.

This is a medium-severity issue (CVSS 4.0 base 5.3) that is a low real-world priority. The only quantitative signal available is the vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N): remote and unauthenticated, but requiring passive user interaction (UI:P) and yielding only LOW impact to confidentiality, integrity, and availability, all confined to the vulnerable system (no scope change). No EPSS score, no CISA KEV listing, and no proof-of-concept were provided in the input, so exploitation status is 'no public exploit identified at time of analysis.' The remaining drivers of real risk - a niche third-party Android document-viewer app ('Lippu Docx Reader') with a tiny deployment footprint, mandatory user interaction, and bounded impact within the app sandbox - all push realistic risk well below what a 5.3 might suggest for widely deployed software. No conflicting signals were detected, but note the data is single-sourced: all references trace back to VulDB/the FDU AF_CVEs issue tracker, with no independent vendor advisory or NVD-enriched CPE to corroborate affected-version boundaries.

An attacker crafts a malicious file (or content) whose '_display_name' argument contains path-traversal sequences and delivers it to a victim (e.g., via download, messaging, or a shared document). When the victim opens it in the Lippu Docx Reader app's ViewTxt function, the unsanitized display name is used in a file path, letting the app read or write files outside its intended directory within the sandbox. No public exploit code was identified in the provided data, and successful exploitation depends on the user actually opening the attacker-supplied file (UI:P).