Executive brief
Zora is a mobile application used for posting, trading, and earning cryptocurrency. A critical security flaw in the app's file import process allows a malicious application on the same device to overwrite the Zora app's internal configuration or executable files. This could allow an attacker to steal sensitive user information, cause the app to crash, or take full control of the application's functions.
Technical details
A path traversal vulnerability (CWE-22) exists in the MainActivity component of the Zora: Post, Trade, Earn Crypto Android application (co.ourzora.app). The vulnerability stems from insufficient validation of filenames and content during the file import process. An attacker can leverage a malicious application to supply a crafted filename containing path traversal sequences (e.g., ../) to overwrite sensitive files within the app's internal storage. Successful exploitation can lead to arbitrary code execution if executable files are replaced, or privilege escalation and data exposure if configuration files are modified. The attack can be triggered automatically when a victim interacts with a malicious app, requiring no complex user interaction.
Affected products
- Zora Labs, Inc Zora: Post, Trade, Earn Crypto 2.60.0
Timeline
- 2026-03-31: disclosed: Vulnerability reported by Secsys-FDU (Fudan University)
- 2026-03-31: advisory: Initial CVE publication