CVE-2018-8909 The Wire application before 2018-03-07 for Android allows attackers to write to pathnames outside of the downloads directory via a ../ in a filename of a received file, related to AssetService.scala.
HighCVSS 7.5
EPSS 1.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The Wire application before 2018-03-07 for Android allows attackers to write to pathnames outside of the downloads directory via a ../ in a filename of a received file, related to AssetService.scala.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| wire | < 2018-03-07 | 2018-03-07 |
References
- www.x41-dsec.de exploit third-party-advisory