A path traversal flaw in Samsung Flow allows a local attacker to read clipboard data by crafting a path that escapes the intended sandbox. The vulnerability is a classic file path manipulation error that lets an attacker retrieve private information stored in the clipboard, potentially exposing sensitive user data. This is an information‑disclosure flaw rather than a privilege escalation or denial of service.

The flaw exists in Samsung Flow on Samsung Mobile devices for any installation prior to version 4.9.22.1. No other vendors or products are affected.

The CVSS score of 5.1 indicates moderate severity. The EPSS score is not available, so no exploitation probability is quantified at present. The vulnerability is not listed in CISA KEV, suggesting limited known exploitation. The attack vector is local; an adversary must have physical or software access to the device and be able to invoke the application or manipulate its file paths. Once the flaw is triggered, the attacker can read the device’s clipboard contents, compromising confidentiality of any data that was copied recently.