ColorOS Assistant contains an unauthenticated end‑point that accepts download requests. The handler fails to validate the file path supplied by the caller, enabling a path‑traversal attack. An attacker can request any file on the device’s filesystem and read its contents, resulting in potential data exfiltration, privacy violations or the delivery of additional malicious payloads. The CVSS score of 7.1 reflects the high impact and remote nature of the vulnerability.

The vulnerability is present in the OPPO ColorOS Assistant application on OPPO devices. No specific firmware or version information is provided, so the risk applies to all current releases that include the unauthenticated start‑download channel until a patch is released.

The vulnerability is exploitable by any entity that can invoke the assistant’s download channel, which is unauthenticated. An EPSS score of 0.00012 indicates a very low probability of exploitation, but the CVSS score indicates a serious threat. The issue is not listed in the CISA KEV catalog, but the path‑traversal flaw combined with unauthenticated access makes it a high‑priority risk for affected OPPO devices. An attacker could trigger the channel remotely—e.g., via a crafted network request or a malicious local application—to read arbitrary files without needing user interaction.