Executive brief
Reader Tools PDF Reader is an Android application for viewing and managing PDF documents. A path traversal vulnerability in the file handler component allows local attackers to manipulate file paths through a display name parameter, potentially enabling unauthorized access to sensitive files on the device.
Technical details
The vulnerability is a path traversal (CWE-22) flaw in the ActSplashNew.handleDeeplink function within the File Handler component of Reader Tools PDF Reader version 98.8 for Android. The vulnerability is triggered by manipulating the _display_name argument, which is not properly validated or sanitized before use in file path operations. The attack vector is local, requiring an attacker with device access or the ability to trigger the vulnerable function through a crafted deep link. An attacker can exploit this to traverse the filesystem and access files outside the intended application directory. The vendor was contacted about the vulnerability but did not respond or provide a patch.
Affected products
- Reader Tools PDF Reader 98.8
Timeline
- 2026-09-02: disclosed