Path Traversal Vulnerability in Polaris Office App for Android
CVE-2026-109106

4.8MEDIUM

Key Information:

Vendor

Polaris

Status
Office App
Vendor
CVE Published:
13 October 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-109106?

A security vulnerability exists in the Polaris Office App version 9.9.19 for Android, specifically in the Document Intake component. This flaw enables a local attacker to manipulate the _display_name argument, potentially allowing unauthorized access to the file system through path traversal. Users are urged to upgrade to version 9.9.22, which includes enhanced path validation logic to restrict file creation to designated temporary directories, effectively mitigating this security risk.

Affected Version(s)

Office App 9.9.19

Office App 9.9.22

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-109106 - Proof of Concept

References

https://vuldb.com/vuln/416857
vdb-entrytechnical-description
https://vuldb.com/vuln/416857/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-109106
third-party-advisory

CVSS V4

Score:
4.8
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
Low
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Actuator (VulDB User)
VulDB CNA Team
.