Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2026-101886 Details

Description

Cisco Jabber for Android (com.cisco.im) before 15.3.1.311364 contains a path traversal vulnerability that allows a malicious app with no permissions to write attacker-controlled files into Jabber's private data directory by exploiting the exported crosslaunch.share activity and an unsanitized display name from a ContentProvider used in file path construction. Attackers can craft a shared content:// URI with a display name containing '../' sequences to place fully attacker-controlled content within directories such as databases/, shared_prefs/, no_backup/, and files/ without user interaction.

Metrics

CVSS 3.x Severity and Vector Strings:

CNA: [email protected]CVSS-B:4 MEDIUMVector:CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://bst.cisco.com/bugsearch/bug/CSCwv96631	[email protected]
https://play.google.com/store/apps/details?id=com.cisco.im	[email protected]
https://www.vulncheck.com/advisories/cisco-jabber-for-android-path-traversal-via-shared-content-uri	[email protected]

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-22	Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')	[email protected]

Affected Products

No affected product data is available for this CVE.

Change History

1 change record found show changes