Cisco Jabber for Android (com.cisco.im) before 15.3.1.311364 contains a path traversal flaw that allows a malicious app with no permissions to write attacker‑controlled files into the app’s private data directory via the exported crosslaunch.share activity. The unsanitized display name from a ContentProvider is used in file path construction, enabling the attacker to craft a content:// URI with '../' sequences. The likely attack vector is a malicious app that constructs this URI, which can be executed without user interaction, allowing files to be placed in directories such as databases/, shared_prefs/, no_backup/, and files/ and potentially modifying configuration or exfiltrating data.

All installations of Cisco Jabber for Android (com.cisco.im) older than version 15.3.1.311364 are affected. The product was distributed through the Google Play Store and any device running a compromised application may be vulnerable.

The CVSS score of 5.1 indicates a moderate impact. The EPSS score is not available and the vulnerability is not listed in CISA KEV. Exploitation requires only a malicious app to be installed; no user interaction or special permissions are needed. The flaw permits arbitrary file writes within the app’s private sandbox, potentially allowing modification of configuration data or the injection of malicious components, but escalation beyond the app’s limits is constrained by standard Android security boundaries.