CVE-2026-84431
Received Received - Intake

Path Traversal in AirAsia MOVE Android App

Publication date: 2026-09-02

Last updated on: 2026-09-02

Assigner: VulDB

Description
A vulnerability was detected in AirAsia MOVE App up to 12.47.1 on Android. This issue affects the function com.airasia.core.utils.RealPathUtil.getRealPath of the component com.airasia.mobile. Performing a manipulation of the argument _display_name results in path traversal. The attack requires a local approach. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-02
Last Modified
2026-09-02
Generated
2026-09-02
AI Q&A
2026-09-02
EPSS Evaluated
N/A
NVD
CVE-2026-84431
EUVD
EUVD-2026-69795

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
airasia move_app to 12.47.1 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a path traversal issue in the AirAsia MOVE App for Android up to version 12.47.1. It exists in the function com.airasia.core.utils.RealPathUtil.getRealPath within the component com.airasia.mobile. An attacker can manipulate the _display_name argument to perform path traversal. The attack requires local access to the device.

Detection Guidance

Since this is a path traversal vulnerability in the AirAsia MOVE app, detection would require analyzing the app's file handling behavior. Check for unusual file access patterns or attempts to access files outside intended directories. Review logs for errors related to com.airasia.core.utils.RealPathUtil.getRealPath. Inspect app permissions and file system interactions.

Impact Analysis

This vulnerability could allow an attacker with local access to traverse directories on your device. This may lead to unauthorized access to sensitive files or data stored on your Android device where the app is installed.

Compliance Impact

The vulnerability involves path traversal in the AirAsia MOVE App, which could allow unauthorized access to files on a user's device. This may impact compliance with GDPR by potentially exposing personal data if sensitive files are accessed. HIPAA compliance could be affected if protected health information is involved, though this CVE does not specify such exposure.

Mitigation Strategies

Uninstall or update the AirAsia MOVE app to the latest version if an update is available. Restrict local file access permissions for the app. Monitor network traffic for suspicious activity. Apply file system restrictions to prevent path traversal attempts. Contact AirAsia support for official patches or guidance.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-84431. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart