Search
Find a vulnerability
Search criteria
2 vulnerabilities by Polaris
CVE-2026-109106 (GCVE-0-2026-109106)
Vulnerability from nvd – Published: 2026-10-13 07:00 – Updated: 2026-10-15 15:12
VLAI
EPSS
VEX
Title
Polaris Office App Document Intake com.infraware.service.m.n.a path traversal
Summary
A security flaw has been discovered in Polaris Office App 9.9.19 on Android. Affected by this vulnerability is the function com.infraware.service.m.n.a of the component Document Intake. The manipulation of the argument _display_name results in path traversal. The attack is only possible with local access. The exploit has been released to the public and may be used for attacks. Upgrading to version 9.9.22 addresses this issue. It is recommended to upgrade the affected component. The vendor confirms: "We added path validation logic to ensure that files are created only within the designated temporary directory."
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-15 14:50 UTC
CWE
- CWE-22 - Path Traversal
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/416857 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/416857/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-109106 | third-party-advisory |
| https://vuldb.com/submit/886481 | third-party-advisory |
| https://docs.google.com/document/d/1HtHrkT1NRX7ZY… | exploit |
| https://play.google.com/store/apps/details?id=com… | patch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Polaris | Office App |
Affected:
9.9.19
Unaffected: 9.9.22 cpe:2.3:a:polaris:office_app:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-109106",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-15T14:50:18.394819Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T15:12:59.959Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:polaris:office_app:*:*:*:*:*:*:*:*"
],
"modules": [
"Document Intake"
],
"product": "Office App",
"vendor": "Polaris",
"versions": [
{
"status": "affected",
"version": "9.9.19"
},
{
"status": "unaffected",
"version": "9.9.22"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Actuator (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security flaw has been discovered in Polaris Office App 9.9.19 on Android. Affected by this vulnerability is the function com.infraware.service.m.n.a of the component Document Intake. The manipulation of the argument _display_name results in path traversal. The attack is only possible with local access. The exploit has been released to the public and may be used for attacks. Upgrading to version 9.9.22 addresses this issue. It is recommended to upgrade the affected component. The vendor confirms: \"We added path validation logic to ensure that files are created only within the designated temporary directory.\""
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 4.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 4.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 3.2,
"vectorString": "AV:L/AC:L/Au:S/C:N/I:P/A:P/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "Path Traversal",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T07:00:17.356Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-416857 | Polaris Office App Document Intake com.infraware.service.m.n.a path traversal",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/416857"
},
{
"name": "VDB-416857 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/416857/cti"
},
{
"name": "CVE-2026-109106 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-109106"
},
{
"name": "Submit #886481 | Polaris Office Corp https://play.google.com/store/apps/details?id=com.infraware.office.link 9.9.19 Path Traversal",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/886481"
},
{
"tags": [
"exploit"
],
"url": "https://docs.google.com/document/d/1HtHrkT1NRX7ZY8uyu_C0F2Scp7wWDcor/edit?usp=sharing\u0026ouid=100768766778062598194\u0026rtpof=true\u0026sd=true"
},
{
"tags": [
"patch"
],
"url": "https://play.google.com/store/apps/details?id=com.infraware.office.link"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-22T00:00:00.000Z",
"value": "Countermeasure disclosed"
},
{
"lang": "en",
"time": "2026-10-12T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-12T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-12T10:26:38.000Z",
"value": "VulDB entry last update"
}
],
"title": "Polaris Office App Document Intake com.infraware.service.m.n.a path traversal",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-109106",
"datePublished": "2026-10-13T07:00:17.356Z",
"dateReserved": "2026-10-12T08:21:34.357Z",
"dateUpdated": "2026-10-15T15:12:59.959Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-109106 (GCVE-0-2026-109106)
Vulnerability from cvelistv5 – Published: 2026-10-13 07:00 – Updated: 2026-10-15 15:12
VLAI
EPSS
VEX
Title
Polaris Office App Document Intake com.infraware.service.m.n.a path traversal
Summary
A security flaw has been discovered in Polaris Office App 9.9.19 on Android. Affected by this vulnerability is the function com.infraware.service.m.n.a of the component Document Intake. The manipulation of the argument _display_name results in path traversal. The attack is only possible with local access. The exploit has been released to the public and may be used for attacks. Upgrading to version 9.9.22 addresses this issue. It is recommended to upgrade the affected component. The vendor confirms: "We added path validation logic to ensure that files are created only within the designated temporary directory."
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-15 14:50 UTC
CWE
- CWE-22 - Path Traversal
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/416857 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/416857/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-109106 | third-party-advisory |
| https://vuldb.com/submit/886481 | third-party-advisory |
| https://docs.google.com/document/d/1HtHrkT1NRX7ZY… | exploit |
| https://play.google.com/store/apps/details?id=com… | patch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Polaris | Office App |
Affected:
9.9.19
Unaffected: 9.9.22 cpe:2.3:a:polaris:office_app:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-109106",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-15T14:50:18.394819Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T15:12:59.959Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:polaris:office_app:*:*:*:*:*:*:*:*"
],
"modules": [
"Document Intake"
],
"product": "Office App",
"vendor": "Polaris",
"versions": [
{
"status": "affected",
"version": "9.9.19"
},
{
"status": "unaffected",
"version": "9.9.22"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Actuator (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security flaw has been discovered in Polaris Office App 9.9.19 on Android. Affected by this vulnerability is the function com.infraware.service.m.n.a of the component Document Intake. The manipulation of the argument _display_name results in path traversal. The attack is only possible with local access. The exploit has been released to the public and may be used for attacks. Upgrading to version 9.9.22 addresses this issue. It is recommended to upgrade the affected component. The vendor confirms: \"We added path validation logic to ensure that files are created only within the designated temporary directory.\""
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 4.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 4.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 3.2,
"vectorString": "AV:L/AC:L/Au:S/C:N/I:P/A:P/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "Path Traversal",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T07:00:17.356Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-416857 | Polaris Office App Document Intake com.infraware.service.m.n.a path traversal",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/416857"
},
{
"name": "VDB-416857 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/416857/cti"
},
{
"name": "CVE-2026-109106 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-109106"
},
{
"name": "Submit #886481 | Polaris Office Corp https://play.google.com/store/apps/details?id=com.infraware.office.link 9.9.19 Path Traversal",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/886481"
},
{
"tags": [
"exploit"
],
"url": "https://docs.google.com/document/d/1HtHrkT1NRX7ZY8uyu_C0F2Scp7wWDcor/edit?usp=sharing\u0026ouid=100768766778062598194\u0026rtpof=true\u0026sd=true"
},
{
"tags": [
"patch"
],
"url": "https://play.google.com/store/apps/details?id=com.infraware.office.link"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-22T00:00:00.000Z",
"value": "Countermeasure disclosed"
},
{
"lang": "en",
"time": "2026-10-12T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-12T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-12T10:26:38.000Z",
"value": "VulDB entry last update"
}
],
"title": "Polaris Office App Document Intake com.infraware.service.m.n.a path traversal",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-109106",
"datePublished": "2026-10-13T07:00:17.356Z",
"dateReserved": "2026-10-12T08:21:34.357Z",
"dateUpdated": "2026-10-15T15:12:59.959Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}