A flaw in the file import process of InTouch Contacts & Caller ID allows an attacker to overwrite any internal file if a crafted input is processed, potentially leading to execution of arbitrary code or leaking sensitive information. The weakness is a classic Absolute Path Traversal (CWE‑22).

InTouch Contacts & Caller ID version 6.38.1 running on Android devices is affected. No other versions or vendors are listed.

The vulnerability scores a high CVSS of 8.4, indicating a severe impact. EPSS is below 1 %, suggesting a low probability of exploitation at this time, and it is not part of the CISA KEV catalog. Exploitation requires the attacker to supply a malicious file or convince a user to import one, so the attack vector is likely to be local or through social engineering. If the import function is invoked, the attacker can overwrite critical files and gain code execution.