Executive brief
UXGROUP LLC Voice Recorder is a mobile application used for recording and managing audio notes. A security vulnerability in the file import process allows a malicious application on the same device to overwrite or read the app's internal data. This could lead to the theft of sensitive user information, account hijacking, or the execution of unauthorized code on the device.
Technical details
An arbitrary file overwrite and read vulnerability exists in UXGROUP LLC Voice Recorder v10.0, specifically within the 'com.kyungeun.timer.activities.overloads.PlayRecordingActivity' component. The flaw stems from insufficient validation of filenames and paths during the file import process, allowing for path traversal attacks (CWE-73). A malicious application on the same device can provide a crafted filename to overwrite critical internal configuration or executable files, or read sensitive data such as 'com.google.android.gms.signin.xml' which contains authentication states. Successful exploitation can lead to arbitrary code execution, persistent application compromise, or account hijacking. The attack requires minimal user interaction, typically triggered when the victim interacts with the malicious application to initiate an import.
Affected products
- UXGROUP LLC Voice Recorder (ac.voicenote.voicerecorder.audio) 10.0
Timeline
- 2026-03-31: disclosed: Vulnerability details published on GitHub by Secsys-FDU
- 2026-03-31: advisory: CVE-2026-30284 published