JVN#98115035: Android App "ELECOM File Manager" vulnerable to directory traversal

Android App “ELECOM File Manager” provided by ELECOM CO.,LTD. contains a directory traversal vulnerability (CWE-22) due to a flaw in the processing of the filenames when extracting the compressed files.

Impact

A remote attacker may create an arbitrary file or overwrite an existing file in a directory which can be accessed with the application privileges.

Solution

Stop using Android App “ELECOM File Manager”
The developer states the product is no longer supported, therefore stop using the product.
According to developer, ELECOM EXtorage Link, the successor to ELECOM File Manager, is not affected by this vulnerability and users are recommended to use ELECOM EXtorage Link.

Products Affected

• Android App “ELECOM File Manager” all versions