The vulnerability allows arbitrary overwrite of internal files during the file import process. An attacker could replace critical application files, leading to arbitrary code execution or information exposure. The weakness corresponds to CWE-22: Path Traversal.

Affected product is Zora: Post, Trade, Earn Crypto version 2.60.0 on Android devices. The issue originates from the application’s file import functionality and impacts the Android platform.

The CVSS score of 9.8 indicates a critical severity. EPSS is below 1%, suggesting low exploitation probability, and it is not listed in CISA KEV catalog. The attack vector is inferred to be through malicious content imported into the app, as the flaw is triggered during file processing. Exploitation would require an attacker to convince a user to import a crafted file or have access to the device’s filesystem to overwrite critical files.