CVE-2025-68713 affects Rakuten Send Anywhere (File Transfer) for Android version 23.2.9. The flaw permits untrusted, permissionless applications to initiate arbitrary file downloads into the app's scoped storage area. Because these files appear in the app's trusted Received interface, an attacker can deliver malicious APK files that may lead to arbitrary code execution. Additionally, oversized file transfers can cause denial-of-service conditions through resource exhaustion. No CVSS score or remediation information is currently available.

The vulnerability allows attackers to bypass permission restrictions to place arbitrary files inside the app's trusted storage interface. This can lead to arbitrary code execution if the attacker delivers a malicious APK file, or denial-of-service conditions by exhausting device resources with large file transfers. This compromises the integrity and availability of the affected application.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should exercise caution when installing untrusted applications and avoid using unverified file transfers with the affected app version.