Polaris Office CVE-2026-109106

Requires LOCAL access to an Android device running Polaris Office App 9.9.19, plus the low-privilege ability (PR:L) to invoke the Document Intake function (com.infraware.service.m.n.a) with attacker-controlled input - for example a co-resident malicious app or a local user feeding a document whose _display_name carries traversal sequences. There is NO remote or network vector (AV:L) and no user interaction is modeled (UI:N). Exploitation is limited to writing files outside the designated temporary directory with only low integrity and low availability impact and no confidentiality disclosure; upgrading to version 9.9.22, which adds path validation, eliminates the condition.

This is a low-priority, low-real-risk issue despite having a public exploit. All signals align toward low severity: the CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N) confirms the attack requires LOCAL access and at least low privileges, not a remote network vector, and impact is limited to low integrity (VI:L) and low availability (VA:L) with NO confidentiality impact (VC:N). The input score of 1.9 (Low) is consistent with a constrained file-write path traversal rather than a code-execution or data-disclosure flaw. A POC is publicly available (hosted on Google Docs via VulDB), but there is NO EPSS score and NO CISA KEV listing provided, and absence of those is not evidence of exploitation - so this remains publicly available exploit code exists, not confirmed active exploitation. The local-only vector plus PR:L privilege requirement sharply limits realistic attack surface: an attacker must already be able to invoke the app's Document Intake function on the device. Note the source is VulDB (a third-party vulnerability database), not the vendor or NVD, though the vendor fix statement is quoted, lending credibility to the technical root cause. Net: genuine but minor bug; patch during routine update cycles rather than as an emergency.

A malicious or compromised application on the same Android device supplies a crafted _display_name containing path traversal sequences to Polaris Office's Document Intake function (com.infraware.service.m.n.a), causing the app to create a file outside its designated temporary directory. A public POC exists (shared via a Google Docs link referenced by VulDB), but exploitation is local-only and limited to low-impact file write, not remote code execution.