CVE-2023-30678

Vulnerability

A zip path traversal vulnerability exists in the Samsung Calendar application prior to version 12.4.07.15 on Android 13. The application fails to properly validate file paths when extracting zip archives, allowing an attacker to write files outside the intended directory. [1]

Exploitation

An attacker must deliver a specially crafted zip archive to the victim, likely through a malicious calendar attachment or import. If the victim opens the archive within the Calendar app, the path traversal sequence (e.g., "../") in the zip entry names causes files to be written to arbitrary locations. No authentication beyond user interaction is required. [1]

Impact

Successful exploitation allows an attacker to write arbitrary files to the device's filesystem. This could lead to overwriting critical system files, planting malicious executables, or modifying application data, potentially resulting in privilege escalation or persistent compromise. [1]

Mitigation

The vulnerability is fixed in Calendar version 12.4.07.15. Users should update the Calendar app via the Galaxy Store or system updates. No workaround is available. [1]