Bluelm Copilot
Monthly
Path traversal (CWE-22) in the ShareActivity component of Vivo's BlueLM Copilot (com.vivo.ai.copilot) allows a malicious application already installed on the same device to write arbitrary files by sending a crafted ACTION_SEND intent whose ContentProvider-supplied file name contains '..' sequences. The flaw is local-only (AV:L) with no confidentiality impact - the assessed vector is C:N/I:L/A:L - so a hostile app must first be present on the device, and exposure is confined to Vivo devices running the Copilot app. It is rated medium severity (CVSS 4.0 base 5.1), flagged by Vivo's own security advisory; no public exploit code or CISA KEV entry was identified at time of analysis, and the vuln.today priority label is 'this_month'.
Path traversal (CWE-22) in the ShareActivity component of Vivo's BlueLM Copilot (com.vivo.ai.copilot) allows a malicious application already installed on the same device to write arbitrary files by sending a crafted ACTION_SEND intent whose ContentProvider-supplied file name contains '..' sequences. The flaw is local-only (AV:L) with no confidentiality impact - the assessed vector is C:N/I:L/A:L - so a hostile app must first be present on the device, and exposure is confined to Vivo devices running the Copilot app. It is rated medium severity (CVSS 4.0 base 5.1), flagged by Vivo's own security advisory; no public exploit code or CISA KEV entry was identified at time of analysis, and the vuln.today priority label is 'this_month'.