CVE-2025-14617

Vulnerability

Overview The vulnerability resides in the component org.jw.jwlibrary.mobile.activity.SiloContainer of the JW Library App. It stems from insufficient security validation when handling imported files, enabling an attacker to control both the filename and content through path traversal sequences [1]. This allows overwriting of arbitrary files within the app's internal storage.

Exploitation

Details Exploitation requires local access, meaning a malicious app must be installed on the same Android device. The attack is triggered automatically when the victim opens the malicious app, which sends an intent with a crafted URI containing path traversal (e.g., ../...) in the _display_name parameter [1]. No further user interaction is needed.

Impact

Successful exploitation can overwrite critical configuration or executable files, leading to application malfunction, denial of service, or arbitrary code execution [1]. The attacker could modify preferences or other sensitive data, potentially compromising the app's integrity and the user's data.

Mitigation

Status As of the publication date, no official patch has been announced. The vendor has been notified, and the exploit is publicly disclosed [1]. Users should exercise caution with third-party apps and monitor for updates from the vendor.