BlueLM Copilot CVE-2026-89229

Requires a separate malicious application already installed on the same Vivo device as BlueLM Copilot; that app must be able to send an ACTION_SEND intent to Copilot's exported ShareActivity and supply a file name through a ContentProvider containing '..' path-traversal sequences. Exploitation is limited by the local-only vector (the attacker must first get a hostile app onto the device), by the single-vendor scope (Vivo devices running BlueLM Copilot only), and by impact confined to file write (integrity/availability) with no confidentiality disclosure. No remote, network, or unauthenticated-from-outside path exists.

This is a medium-severity local file-write flaw, not an urgent priority. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L, score 5.1) confirms the attack is local: it requires a malicious application already present on the same Vivo device, not remote network exploitation. Impact is limited to integrity and availability (both Low) with no confidentiality loss, consistent with an arbitrary file-write via path traversal rather than code execution or data theft. The vuln.today decision label is 'this_month', not act_now/emergency, aligning with the modest severity. No EPSS score, no CISA KEV listing, and no PoC or exploit reference were provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The key limiting factor - the need for a pre-installed hostile app on the device - substantially reduces real-world risk below what a raw 'path traversal + arbitrary write' label might suggest. No conflicting signals are present; the main gap is the absence of EPSS/KEV/PoC data, whose absence is expected for a freshly vendor-reported mobile issue and is not itself an error.

A user installs a malicious or trojanized app alongside the pre-installed BlueLM Copilot on their Vivo Android phone. That app sends a crafted ACTION_SEND intent to Copilot's ShareActivity, supplying a ContentProvider file name containing '..' sequences, which causes Copilot to write attacker-controlled content outside its intended directory (potentially overwriting the victim app's own files). No public exploit code or PoC reference was provided for this CVE.