Path traversal allows tricking the Talk Android app into writing files into it's root directory

CVE-2023-39957

What is CVE-2023-39957?

The Nextcloud Talk app for Android, which facilitates video and audio calls, has a vulnerability that allows malicious third-party applications to exploit an unprotected intent. This flaw could trick the Talk app into writing files outside of its intended cache directory, potentially compromising user data. The issue has been resolved in version 17.0.0, and users are advised to update to this version as no workaround is available.

References