Is there a public PoC exploit available for CVE-2026-18853?

Yes, a public proof-of-concept exploit is available for CVE-2026-18853. Prioritise patching immediately. EPSS: 0.2%.

Meme Generator App CVE-2026-18853

Q: What is the CVSS score of CVE-2026-18853?

CVE-2026-18853 has a CVSS 4.0 base score of 1.9 (Low). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-53009 LOW

Path Traversal (CWE-22)

2026-08-04 VulDB

GHSA-jgv4-jf86-9wqc

Path Traversal Google Meme Generator App

1.9

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

1.9 MEDIUM

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.3 MEDIUM

Local access and low-privilege required per description and AV:L/PR:L in CVSS 4.0 vector; no scope change; all impacts limited and partial per Android sandbox constraints.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 05, 2026 - 00:30 vuln.today

Severity Changed

Aug 05, 2026 - 00:22 NVD

MEDIUM LOW

CVSS changed

Aug 05, 2026 - 00:22 NVD

4.8 (MEDIUM) 1.9 (LOW)

CVE Published

Aug 04, 2026 - 23:45 cve.org

LOW 1.9

DescriptionCVE.org

A security vulnerability has been detected in ZomboDroid Meme Generator App 4.6830 on Android. This issue affects the function t5.l.c of the component com.zombodroid.MemeGenerator. Such manipulation leads to path traversal. Local access is required to approach this attack. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Path traversal in ZomboDroid Meme Generator App 4.6830 for Android exposes file system access beyond intended directories through manipulation of function t5.l.c in the com.zombodroid.MemeGenerator component. Exploitation is constrained to local access, yielding limited confidentiality, integrity, and availability impact consistent with the CVSS 4.0 score of 1.9. A public proof-of-concept is available on GitHub, though no patch has been released and the vendor did not respond to coordinated disclosure - leaving no official remediation path.

Technical ContextAI

The vulnerability resides in function t5.l.c within the com.zombodroid.MemeGenerator Android application component. CWE-22 (Path Traversal) identifies the root cause as insufficient sanitization of attacker-controlled input used in file path construction, allowing directory traversal sequences such as '../' to escape intended boundaries. The CPE string cpe:2.3:a:zombodroid:meme_generator_app:*:*:*:*:*:*:*:* uses a wildcard version field, suggesting NVD has not bounded the affected range to a specific version beyond the reported 4.6830. On Android, path traversal impact is shaped by the app's declared storage permissions and the Android version's sandbox enforcement - external shared storage is more accessible than internal app-private directories, so the real scope of accessible files depends on the runtime permission grant.

RemediationAI

No vendor-released patch has been identified at time of analysis; the vendor did not respond to coordinated disclosure. Users concerned about file access integrity should consider uninstalling ZomboDroid Meme Generator App until an official fix is released. As a compensating control, revoke storage permissions for the app via Android device settings (Settings > Apps > Meme Generator > Permissions > Storage), which restricts the directories reachable via path traversal - note this will likely break core app functionality such as saving or loading meme templates. On enterprise-managed Android devices, MDM policies can enforce app blocklisting or storage permission restrictions without user action. The public PoC is documented at https://github.com/actuator/com.zombodroid.MemeGenerator/ and the VulDB entry at https://vuldb.com/vuln/385863 for technical reference.