CVE-2026-84431: Path Traversal in AirAsia MOVE App

This vulnerability affects the AirAsia MOVE App on Android up to versions 12.47.0 and 12.47.1. It arises from insufficient validation in the getRealPath function of the RealPathUtil component, allowing an attacker with local access to manipulate the _display_name parameter to perform path traversal. This could potentially allow access to unauthorized file system locations. The vendor has not responded to disclosure, and no official fix or patch is currently available. Exploit code is publicly available, but no known active exploitation in the wild has been reported.

An attacker with local access to the device can exploit this vulnerability to perform path traversal, potentially accessing files or directories outside the intended scope of the application. This may lead to unauthorized information disclosure or other impacts depending on the files accessed. The CVSS score of 4.8 (medium severity) reflects the limited attack vector (local) and the requirement for low privileges.

No official fix or patch is currently available from the vendor. Users should avoid running untrusted code or applications on devices with affected versions of the AirAsia MOVE App. Monitor vendor channels for any future updates or patches addressing this issue.