CVE-2026-89038 is a path traversal vulnerability in Verizon Cloud for Android (com.vcast.mediamanager) versions prior to 26.7.10. The flaw arises from insufficient sanitization of the _display_name parameter in the exported activities OneTouchUploadActivity and PrintShopCloudActivity. By sending crafted ACTION_SEND or ACTION_SEND_MULTIPLE intents containing path traversal sequences, a malicious co-resident application can write attacker-controlled data outside the intended staging directory. This allows arbitrary file writes and injection of content into the user's Verizon Cloud account without requiring user interaction.

An attacker with a malicious app on the same Android device can exploit this vulnerability to write arbitrary files outside the designated staging directory. This can lead to unauthorized content injection into the victim's Verizon Cloud account, potentially compromising data integrity and user trust. The vulnerability does not require user interaction and can be triggered remotely via intents.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users and administrators should monitor Verizon's official channels for updates or patches addressing this vulnerability. Until a fix is available, restricting installation of untrusted applications and limiting exposure to potentially malicious apps may reduce risk.