CVE-2026-89229 — Vulnerability intelligence
—
Published:
- CVSS
- 5.1
- CISA KEV
- Not listed; not proof of no exploitation
Original source text (not a translation)
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in the ShareActivity component of BlueLM Copilot (com.vivo.ai.copilot) allows a malicious application installed on the same device to write arbitrary files via a crafted ACTION_SEND intent with a ContentProvider-supplied file name containing '..' sequences.