CVE-2026-109106
Received Received - Intake

Path Traversal in Polaris Office App for Android

Publication date: 2026-10-13

Last updated on: 2026-10-13

Assigner: VulDB

Description
A security flaw has been discovered in Polaris Office App 9.9.19 on Android. Affected by this vulnerability is the function com.infraware.service.m.n.a of the component Document Intake. The manipulation of the argument _display_name results in path traversal. The attack is only possible with local access. The exploit has been released to the public and may be used for attacks. Upgrading to version 9.9.22 addresses this issue. It is recommended to upgrade the affected component. The vendor confirms: "We added path validation logic to ensure that files are created only within the designated temporary directory."

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-13
Last Modified
2026-10-13
Generated
2026-10-13
AI Q&A
2026-10-13
EPSS Evaluated
N/A
NVD
CVE-2026-109106
EUVD
EUVD-2026-98317

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Polaris Office App 9.9.19

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a path traversal flaw in Polaris Office App 9.9.19 on Android. It exists in the function com.infraware.service.m.n.a within the Document Intake component. An attacker can manipulate the _display_name argument to traverse outside intended directories, potentially accessing unauthorized files. The attack requires local access to the device. The vendor fixed this in version 9.9.22 by adding path validation to restrict file creation to a designated temporary directory.

The exploit has been publicly disclosed, increasing the risk of attacks. The vulnerability is classified as low severity with a CVSS v3.1 score of 4.4, indicating limited impact but still requiring attention.

Detection Guidance

This vulnerability involves path traversal in the Polaris Office App 9.9.19 on Android via the function com.infraware.service.m.n.a. To detect it, check if the app version is 9.9.19 or earlier. Look for unusual file access patterns or attempts to traverse directories outside the designated temporary folder.

Impact Analysis
  • Unauthorized file access: Attackers could read sensitive files stored on your device if they gain local access.
  • Data leakage: Confidential documents processed by the app might be exposed.
  • Malware delivery: Attackers could place malicious files in unintended locations.
  • App instability: Malicious path manipulation might crash the app or corrupt files.
Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA by enabling unauthorized access to personal or health data. GDPR requires protecting personal data, and HIPAA mandates safeguards for health information. A breach could result in legal penalties, reputational damage, and loss of user trust.

Mitigation Strategies

Immediately upgrade the Polaris Office App to version 9.9.22 or later to address the vulnerability. Remove any older versions of the app from your devices. Monitor for any suspicious activity related to file access or directory traversal.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109106. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart