EUVD-2026-34966
GHSA-qfjx-g344-4pcg
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
4DescriptionCVE.org
A security flaw has been discovered in iAI Lab PDF AI App 4.21.0 on Android. Impacted is the function getExternalCacheDir of the component chatpdf.pro. Performing a manipulation of the argument _display_name results in path traversal. The attack requires a local approach. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Path traversal in iAI Lab PDF AI App 4.21.0 on Android allows a local low-privileged attacker to manipulate the _display_name argument within the getExternalCacheDir function of the chatpdf.pro component, enabling unauthorized file system access outside the intended cache directory. The CVSS 4.0 score of 1.9 reflects the strictly local attack surface and limited integrity and availability impact with no confidentiality breach. A public proof-of-concept exploit has been released; the vendor was contacted prior to disclosure and did not respond, leaving the vulnerability unpatched.
Technical ContextAI
The affected code resides in the chatpdf.pro component of iAI Lab PDF AI App 4.21.0 (Android), specifically in the getExternalCacheDir function - an Android API call that returns the application's cache directory on external storage. CWE-22 (Path Traversal) indicates the root cause: the application fails to sanitize or validate the _display_name argument before using it in a file path construction, allowing an attacker to inject traversal sequences (e.g., ../../) and escape the intended cache directory boundary. On Android, external cache directories are accessible to apps with appropriate storage permissions, making this traversal a meaningful sandbox violation on affected devices. The CPE string cpe:2.3:a:iai_lab:pdf_ai_app:*:*:*:*:*:*:*:* covers all versions, though only 4.21.0 is explicitly confirmed as affected in this report.
RemediationAI
No vendor-released patch is available at the time of analysis; the vendor did not respond to responsible disclosure. The primary remediation is to uninstall iAI Lab PDF AI App 4.21.0 from affected Android devices until a patched release is confirmed. As a compensating control, administrators managing enterprise Android fleets via MDM should blocklist the application (package identifier associated with chatpdf.pro) until resolution. Users who must retain the app should restrict external storage permissions for the application via Android Settings > Apps > Permissions > Storage, which limits the blast radius of any traversal by constraining writable scope - note this may degrade app functionality that depends on external cache. The public POC is documented at https://github.com/actuator/chatpdf.pro and should be reviewed by defenders to understand the traversal path and assess exposure of sensitive files in adjacent external storage directories.
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today