CVE-2026-108544: Path Traversal in Lippu Docx Reader Office Viewer App

This vulnerability in Lippu Docx Reader Office Viewer App up to version 1.4.5 on Android allows remote attackers to perform path traversal by manipulating the _display_name argument in the ViewTxt function. This could enable unauthorized access to files outside the intended directory scope. The vulnerability does not require privileges or user interaction beyond what is specified, and the attack complexity is low. No known exploits are reported in the wild, and no official patch or remediation information is provided in the source data.

Successful exploitation could allow an attacker to read arbitrary files on the device by traversing directories via the _display_name parameter. This may lead to unauthorized disclosure of sensitive information stored on the device. However, the vulnerability requires user interaction and has limited scope and impact as indicated by the medium CVSS score.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when opening documents with the affected app versions and avoid untrusted sources. Monitor vendor communications for updates regarding patches or mitigations.