Executive brief
A vulnerability in the My Text Editor mobile application allows a malicious app installed on the same device to bypass security boundaries. By tricking a user into interacting with a malicious file or link, an attacker can write unauthorized data into the editor's private storage. This can lead to the application crashing, running out of storage space, or becoming completely unusable, resulting in a denial of service for the user.
Technical details
A path traversal vulnerability exists in My Text Editor (joa.zipper.editor) v1.6.2 due to insufficient validation during the file import process. Specifically, the 'joa.zipper.editor.Main' component fails to sanitize filenames provided via the 'Intent.EXTRA_STREAM' extra. A local malicious application can exploit this by sending a crafted Intent containing path traversal sequences (e.g., '../../') in the URI's display name. This allows the attacker to write arbitrary content to the application's internal data directory, potentially leading to a Denial of Service (DoS) by exhausting storage or overwriting critical application files. User interaction is required to trigger the malicious intent.
Affected products
- Jin Yong-hoon (zipperapp) My Text Editor 1.6.2
Timeline
- 2026-01-30: disclosed: Vulnerability details and PoC published on GitHub by Secsys-FDU.
- 2026-02-05: advisory: CVE-2025-69619 published.