Pdf Ai App
Monthly
Path traversal in iAI Lab PDF AI App 4.21.0 on Android allows a local low-privileged attacker to manipulate the `_display_name` argument within the `getExternalCacheDir` function of the `chatpdf.pro` component, enabling unauthorized file system access outside the intended cache directory. The CVSS 4.0 score of 1.9 reflects the strictly local attack surface and limited integrity and availability impact with no confidentiality breach. A public proof-of-concept exploit has been released; the vendor was contacted prior to disclosure and did not respond, leaving the vulnerability unpatched.
Path traversal in iAI Lab PDF AI App 4.21.0 on Android allows a local low-privileged attacker to manipulate the `_display_name` argument within the `getExternalCacheDir` function of the `chatpdf.pro` component, enabling unauthorized file system access outside the intended cache directory. The CVSS 4.0 score of 1.9 reflects the strictly local attack surface and limited integrity and availability impact with no confidentiality breach. A public proof-of-concept exploit has been released; the vendor was contacted prior to disclosure and did not respond, leaving the vulnerability unpatched.