Executive brief
The Tarot, Astro & Healing mobile application contains a security flaw in how it handles imported files. An attacker can use a malicious app to overwrite the application's internal configuration or executable files. This could lead to the app malfunctioning, the theft of sensitive user information, or the execution of unauthorized commands on the device.
Technical details
An arbitrary file overwrite vulnerability exists in the com.eveworld.coto.view.MainActivity component of the Tarot, Astro & Healing Android application (v11.4.0). The flaw stems from insufficient validation of the '_display_name' parameter during the file import process, which is susceptible to path traversal sequences (e.g., ../). A malicious application on the same device can send a crafted Intent (ACTION_SEND) with a manipulated URI to overwrite critical files in the app's internal storage, such as shared preferences or executable binaries. This can result in arbitrary code execution, denial of service, or exposure of sensitive application data. The attack requires minimal user interaction, typically just opening a malicious application.
Affected products
- COMMUNITY PLATFORM PTE. LTD. Tarot, Astro & Healing (world.eve.coto) 11.4.0
Timeline
- 2026-01-30: disclosed: Vulnerability details and PoC shared on GitHub by Secsys-FDU
- 2026-02-04: advisory: CVE published