Path Traversal Vulnerability in BlueLM Copilot by VIVO
CVE-2026-89229

5.1MEDIUM

Key Information:

Vendor

Vivo

Status
Bluelm Copilot
Vendor
CVE Published:
3 November 2026

What is CVE-2026-89229?

The BlueLM Copilot application contains a path traversal vulnerability in its ShareActivity component. This issue enables a malicious application installed on the same device to exploit the vulnerability by sending a crafted ACTION_SEND intent. If the intent contains a file name with '..' sequences, it permits the writing of arbitrary files to restricted directories, which could compromise user data and application integrity.

Affected Version(s)

BlueLM Copilot 0 < 7.2.0.0

References

https://www.vivo.com/en/support/security-advisory-detail?...

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
Low
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.