The BlueLM Copilot ShareActivity component contains a path traversal flaw. An attacker that has installed a malicious application on the same device can craft an ACTION_SEND intent whose ContentProvider supplies a filename containing '..' sequences. The unvalidated filename is used when writing files, enabling the malicious app to place arbitrary files anywhere within the device's storage. This can lead to overwrite of critical files, installation of malware, or escalation of privileges, affecting confidentiality, integrity, and availability.

This flaw affects vivo's BlueLM Copilot (com.vivo.ai.copilot). No specific version is listed, so all releases current at the time of the advisory are potentially vulnerable.

The CVSS score of 5.1 indicates moderate severity. EPSS is not available, and the vulnerability is not listed in CISA's KEV catalog. The exploitation requires that a malicious application be installed on the device, after which it can send a crafted intent to the ShareActivity component. The attack vector is local, leveraging the Android intent system, and does not require network access. Once executed, the attacker can write files arbitrarily, so the risk is materialized if vulnerable versions remain in use and the device allows installation of untrusted apps.