CVE-2025-14699
Path Traversal in Municorn FAX App 3.27.0 Allows Local Exploit
Publication date: 2025-12-15
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| municorn | fax_app | 3.27.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-22 | The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-14699 is a path traversal vulnerability in Municorn FAX App version 3.27.0 for Android. It occurs because the app improperly handles external input used to build file or directory paths, failing to neutralize special path elements. This allows an attacker with local access to manipulate file paths to write files outside the intended directory within the app's internal storage. The vulnerability can be exploited by crafting malicious inputs, such as specially constructed URIs, to perform arbitrary file writes, breaking sandbox isolation. [1, 3]
How can this vulnerability impact me? :
This vulnerability can impact you by allowing an attacker with local access to write arbitrary files into the app's internal storage, potentially leading to denial of service by exhausting storage or memory, compromising data integrity, and affecting the confidentiality, integrity, and availability of the affected system. The exploit is easy to perform and can be triggered without complex user interaction, increasing the risk of unauthorized file manipulation and system disruption. [1, 2, 3]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring for suspicious local activity involving the Municorn FAX App (biz.faxapp.app), specifically looking for attempts to exploit path traversal via crafted Intents targeting the app's file import process. Detection may involve checking for unusual file writes outside the app's intended directories, such as files appearing in /data/data/biz.faxapp.app/ that should not be there. Since the exploit uses specially crafted URIs with path traversal sequences in the '_display_name' parameter, monitoring app logs or using Android debugging tools (adb) to inspect Intent data and file system changes could help. Example commands include using adb shell to list unexpected files: `adb shell ls -l /data/data/biz.faxapp.app/` and monitoring logcat for suspicious Intent handling: `adb logcat | grep biz.faxapp.app`. However, no specific detection commands are provided in the resources. [1, 3]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting local access to the affected device to prevent exploitation, as the attack requires local access. Since no official patches or countermeasures have been provided by the vendor, it is recommended to consider replacing the affected Municorn FAX App version 3.27.0 with an alternative fax application that does not have this vulnerability. Additionally, monitoring and limiting app permissions and usage may reduce risk. Avoid installing untrusted applications that could trigger the exploit. No known fixes or updates are available from the vendor. [1, 2]