VYPR
← All advisories
High severity7.5NVD Advisory· Published Mar 22, 2018· Updated Jun 17, 2026

CVE-2018-8909

CVE-2018-8909

Description

The Wire application before 2018-03-07 for Android allows attackers to write to pathnames outside of the downloads directory via a ../ in a filename of a received file, related to AssetService.scala.

Affected products

3
  • Wordapp/Wire Androidinferred
    Range: <2018-03-07
  • Wire/Wire2 versions
    cpe:2.3:a:wire:wire:*:*:*:*:*:android:*:*+ 1 more
    • cpe:2.3:a:wire:wire:*:*:*:*:*:android:*:*range: <2018-03-07
    • (no CPE)range: < 2018-03-07

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.