Executive brief
A vulnerability exists in the 'Play All Videos' Android application, a utility used for playing and managing video files. An attacker can use a malicious file to overwrite the app's internal configuration or system files when a user imports content. This could lead to the app crashing, the theft of sensitive user information, or the execution of unauthorized commands on the device.
Technical details
An arbitrary file overwrite vulnerability exists in the MainActivity component (com.kaisquare.location.MainActivity) of the 'Video player - Play All Videos' Android app (version 1.0.135). The flaw is rooted in insufficient validation of filenames and paths during the file import process, specifically failing to prevent path traversal sequences. A local attacker can craft a malicious application or file that, when processed by the vulnerable app, overwrites sensitive files in the application's internal storage. This can result in arbitrary code execution if executable files are replaced, or information exposure and denial of service if configuration files are corrupted. Exploitation requires minimal user interaction, typically just opening a malicious file or app.
Affected products
- RAREPROB SOLUTIONS PRIVATE LIMITED Video player - Play All Videos (rocks.video.videoplayer) 1.0.135
Timeline
- 2026-03-31: disclosed: Initial disclosure via GitHub issue and NVD publication
- 2026-03-31: advisory