Executive brief
Comic Book Reader is a mobile application used to view digital comic files. A security flaw in the app's file import process allows a malicious application on the same device to overwrite the reader's internal configuration and system files. This could lead to the theft of sensitive user data, application crashes, or the execution of unauthorized commands.
Technical details
A path traversal vulnerability (CWE-22) exists in the MainActivity component of the Comic Book Reader Android application (ru.androidtools.comic_book_magazine_reader_cbr_cbz). The application fails to properly validate the '_display_name' parameter provided by a Content Provider during a file import via Intent.ACTION_VIEW. An attacker can craft a malicious app that serves a file with a manipulated filename containing traversal sequences (e.g., '../../'), allowing them to overwrite sensitive files in the application's internal storage, such as shared preferences or databases. This can result in arbitrary code execution or exposure of sensitive information. The attack requires minimal user interaction, typically just opening a malicious file or link that triggers the app.
Affected products
- Vladimir Timofeev Comic Book Reader (cbz/cbr) 1.0.95
Timeline
- 2026-01-30: disclosed: Vulnerability reported by Secsys-FDU laboratory
- 2026-02-04: advisory: CVE published to NVD