CVE-2026-109106: Path Traversal in Polaris Office App

This vulnerability in Polaris Office App 9.9.19 on Android involves improper validation of the _display_name argument in the Document Intake component's function com.infraware.service.m.n.a. An attacker with local access can exploit this path traversal flaw to manipulate file paths, potentially leading to unauthorized file creation or access outside intended directories. The vendor addressed the issue in version 9.9.22 by implementing path validation logic to ensure files are created only within a designated temporary directory.

The vulnerability allows an attacker with local access to perform path traversal via the _display_name argument, potentially enabling unauthorized file creation or access outside the intended directory. The CVSS score of 4.8 indicates a medium severity impact with limited attack vector (local access) and no user interaction required. There is no indication of remote exploitation or privilege escalation beyond local access.

Upgrade Polaris Office App to version 9.9.22 or later, where the vendor has implemented path validation logic to restrict file creation to the designated temporary directory. This official fix addresses the vulnerability. No additional mitigation is required if the upgrade is applied.