CVE-2025-26427

Published: Sep 4, 2025Modified: Jun 17, 2026

4.4

Vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Exploitability: 1.8 / Impact: 2.5

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

In multiple locations, there is a possible Android/data access due to a path traversal error. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.

Affected (2)

Products: Google: Android

Google

1 product

Android

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Google Android	Version 13.0
Google Android	Version 14.0

Related CWEs

CWE-24

Path Traversal: '../filedir'

The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize "../" sequences that can resolve to a location that is outside of that directory.

References (3)

https://android.googlesource.com/platform/frameworks/base/+/4af5db76f25348849252e0b8a08f4a517ef842b7

Source: security@android.com

Patch

https://android.googlesource.com/platform/packages/providers/DownloadProvider/+/5acd646e0cf63e2c9c0862da7e03531ef0074394

Source: security@android.com

Patch

https://source.android.com/security/bulletin/2025-05-01

Source: security@android.com

Vendor Advisory

Timeline

No history available yet.