Executive brief
ZomboDroid Meme Generator is an Android app that allows users to create and share memes. The app contains a path traversal vulnerability in how it handles image file names when receiving shared content. An attacker with another app installed on the device can write arbitrary files to the Meme Generator app's private storage directory, potentially overwriting application data or injecting malicious content.
Technical details
This is a path traversal (CWE-22) vulnerability in the exported ACTION_SEND broadcast receivers of ZomboDroid Meme Generator. The vulnerability exists in function t5.l.c() of component com.zombodroid.memegen6source.ShareToMemeGen (and three related components). When the app copies received image files into its private storage, it extracts the destination filename directly from the content URI's DISPLAY_NAME attribute without sanitization or canonicalization, allowing directory traversal sequences (../) in the filename to write files outside the intended /data/data/com.zombodroid.MemeGenerator/files/customMemeImages/ directory. An attacker can exploit this by distributing a zero-permission app that exports a content provider returning a malicious DISPLAY_NAME like "../malicious.png", then triggering the vulnerable receiver via ACTION_SEND intent with no user interaction beyond the receiver launching. The vendor was contacted early but did not respond. The fix requires stripping the path component from DISPLAY_NAME before use and validating the canonical path stays within the intended directory.
Affected products
- ZomboDroid Meme Generator 4.6825, 4.6830
Timeline
- 2026-08-05: disclosed: Vulnerability published on NVD
- 2026-08-05: advisory: GitHub advisory released with proof-of-concept code