A vulnerability in Polaris Office App 9.9.19 on Android allows an attacker to craft the _display_name argument for the Document Intake component, which results in path traversal. This flaw enables the application to write files to arbitrary locations within its temporary directory, potentially allowing local code execution or data tampering. The weakness is classified as CWE-22 and scored moderately in CVSS (4.8). The public exploit indicates that the issue has been released to attackers, while the attack can only be performed with local access to the device or the app’s runtime.

The affected product is Polaris Office App for Android, version 9.9.19. The vendor has released an update (9.9.22) that adds path validation logic to restrict file creation to the designated temporary directory.

With a CVSS score of 4.8 and no EPSS data available, the risk is moderate. The flaw is not listed in CISA KEV, and exploitation requires local access—so an attacker would need physical presence or the ability to run code within the app context. Because the public exploit is available, the likelihood of local exploitation is non-negligible for any compromised or authorized device user.