The vulnerability is a path traversal flaw in the UnzipUtil module of the JoyConDroid application. It allows an attacker to craft a ZIP archive that contains filenames designed to navigate outside the intended extraction directory. When the application processes such a file, it may read or save files located anywhere on the device’s file system, including sensitive configuration or user data. The flaw can lead to information disclosure and potentially compromise application integrity.

TeamJCD JoyConDroid is affected in all releases up to and including version 1.0.93. No later version is listed as affected.

The CVSS score of 8.6 indicates a high severity level. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector involves an attacker supplying a malicious ZIP file to the device, either by social engineering or by other means of file transfer, after which the application extracts the archive and is able to read arbitrary files. The vulnerability can be exploited with minimal effort if the app is executed with sufficient privileges to traverse the file system.