Hi Browser
Monthly
Arbitrary file write via path traversal in TECNO Mobile's Hi Browser 2.23.1.1 on Android exposes device filesystems to attacker-controlled writes when a user downloads a crafted file with traversal sequences in its filename. Any server delivering a download with a malicious Content-Disposition filename can redirect the saved file outside the intended download directory, potentially overwriting application data or configuration files on the device. No confirmed active exploitation (not in CISA KEV) and an EPSS score of 0.24% (15th percentile) indicate low real-world exploitation probability despite the high CVSS base score.
Arbitrary file write via path traversal in TECNO Mobile's Hi Browser 2.23.1.1 on Android exposes device filesystems to attacker-controlled writes when a user downloads a crafted file with traversal sequences in its filename. Any server delivering a download with a malicious Content-Disposition filename can redirect the saved file outside the intended download directory, potentially overwriting application data or configuration files on the device. No confirmed active exploitation (not in CISA KEV) and an EPSS score of 0.24% (15th percentile) indicate low real-world exploitation probability despite the high CVSS base score.