Executive brief
HIBrowser is a file browser application for Android devices. A path traversal vulnerability in its download feature allows attackers to write arbitrary files to the device's filesystem by manipulating filenames with directory traversal sequences, potentially compromising device security and user data.
Technical details
The vulnerability exists in the download file feature of com.talpa.hibrowser version 2.23.1.1, where user-supplied filename parameters are not properly sanitized before being used in file write operations. An attacker can exploit this by crafting download requests with directory traversal sequences (e.g., "../") in the filename, allowing them to write files outside the intended download directory. The attack requires a download operation to be initiated, either through direct user interaction or a malicious download link. No authentication is required, and the vulnerability allows arbitrary file placement on the device, which could lead to application compromise or device manipulation.
Affected products
- Talpa HIBrowser 2.23.1.1
Timeline
- 2026-08-05: disclosed