CVE-2026-12190

Vulnerability

A path traversal vulnerability exists in Genspark AI Workspace App version 2.8.4 (versionCode 28401) on Android. The exported MainActivity accepts ACTION_SEND, ACTION_SEND_MULTIPLE, and ACTION_VIEW intents carrying a content:// URI. When processing such intents, the app reads the _display_name column from the content URI and uses it verbatim as the destination filename for a file copy operation. No sanitization or canonical-path containment check is performed, allowing an attacker to supply a _display_name containing ../ sequences to escape the intended cache directory. The vulnerable sink is in Lv3/f;->k(Context, Uri, String, String[])String in smali/v3/f.smali [1].

Exploitation

An attacker must have a malicious app installed on the same Android device (local environment). No permissions are required on the attacker app. The attacker app sends an ACTION_SEND intent with a content:// URI where the _display_name field contains path traversal payloads (e.g., ../shared_prefs/POC_RING2.xml). The victim app's MainActivity.onNewIntent triggers the vulnerable code path, which copies the file from the attacker-provided URI to a destination under the app's internal data directory, using the unsanitized filename. The attacker can write to subdirectories such as cache, code_cache, shared_prefs, and files [1].

Impact

Successful exploitation allows an attacker to write arbitrary files into the Genspark app's UID-protected internal storage tree. This can overwrite critical files such as shared preferences, code cache, or other data, potentially leading to privilege escalation, data corruption, or further compromise of the app's functionality. The attack does not require user interaction and has a high integrity impact, though confidentiality and availability are not directly affected [1].

Mitigation

As of the publication date, the vendor (Genspark / iAI Lab) has not responded to the disclosure and no patch or fixed version has been released. Users are advised to restrict installation of untrusted apps on their devices and monitor for updates from the vendor. No workaround is available within the app itself [1].