CVE-2024-25466: React Native Document Picker Path Traversal

CVE-2024-25466 Overview

CVE-2024-25466 is a directory traversal vulnerability in the React Native Document Picker library affecting versions prior to v9.1.1. The flaw resides in the Android library component and allows a local attacker to execute arbitrary code by supplying a crafted script through the document picker interface. The vulnerability is tracked under CWE-26: Path Traversal: '/dir/../filename' and impacts mobile applications that integrate the vulnerable package for document selection functionality on Android devices.

Critical Impact
A local attacker can leverage a crafted file path to escape the intended directory boundary and execute arbitrary code on Android devices running applications that bundle vulnerable versions of react-native-document-picker.

Affected Products

react-native-documents/document_picker versions prior to v9.1.1
Android applications built with React Native that integrate the vulnerable library component
Mobile applications using the vulnerable native Android module RNDocumentPickerModule

Discovery Timeline

2024-02-16 - CVE-2024-25466 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2024-25466

Vulnerability Analysis

The vulnerability exists in the Android bridge module of the React Native Document Picker library. The native Android component fails to properly validate or sanitize file path inputs supplied through the JavaScript-to-native bridge. An attacker with local access can craft input containing traversal sequences such as ../ that escape the intended sandbox directory and reference arbitrary locations on the device's filesystem.

Successful exploitation results in arbitrary code execution within the context of the vulnerable application. Because React Native applications frequently run with elevated permissions granted by the user, exploitation can lead to unauthorized file access, tampering, and full compromise of application data. The impact spans confidentiality, integrity, and availability of the affected mobile application.

Root Cause

The root cause is improper input validation in the file path handling logic of RNDocumentPickerModule.java. The Android component processes file references without stripping or normalizing path traversal metacharacters before performing filesystem operations. Refer to the affected source in the react-native-document-picker repository for the pre-patch implementation.

Attack Vector

Exploitation requires local access to the target device and low-privilege authentication. The attacker delivers a crafted script or file reference that the vulnerable Android component processes. Because the vulnerability requires no user interaction beyond invoking the document picker, a malicious application co-resident on the device or a compromised process can trigger the traversal without alerting the user. A proof-of-concept is documented in the CVE-2024-25466 PoC repository.

No verified exploitation code is reproduced here. See the linked references for technical details.

Detection Methods for CVE-2024-25466

Indicators of Compromise

Presence of react-native-document-picker versions earlier than v9.1.1 in application dependency manifests such as package.json or yarn.lock
File access events from React Native applications targeting paths outside the expected application sandbox directory
Unexpected child processes or script execution originating from mobile applications that integrate the document picker library

Detection Strategies

Perform Software Composition Analysis (SCA) across mobile build pipelines to identify vulnerable versions of react-native-documents/document_picker
Audit Android application logs for file path arguments containing ../ sequences passed to the document picker bridge
Review CI/CD artifacts and published APKs for bundled vulnerable versions of the library

Monitoring Recommendations

Monitor mobile device management (MDM) telemetry for applications loading the vulnerable native module
Track dependency updates in mobile application repositories to confirm remediation to v9.1.1 or later
Alert on anomalous file system access patterns from React Native applications, particularly reads outside the application data directory

How to Mitigate CVE-2024-25466

Immediate Actions Required

Upgrade react-native-document-picker to version v9.1.1 or later in all affected mobile applications
Rebuild and redistribute Android application binaries to end users through official app stores or MDM channels
Inventory all mobile projects to identify additional integrations of the vulnerable package

Patch Information

The issue is fixed in react-native-document-picker version v9.1.1. Update the dependency in package.json and reinstall packages, then rebuild the Android application. See the react-native-document-picker repository for release notes and patched source.

Workarounds

If immediate upgrade is not feasible, remove or disable functionality that invokes the vulnerable document picker component
Apply application-level input validation on file paths returned from the document picker before passing them to filesystem operations
Restrict application file access to the sandbox directory using Android scoped storage APIs

bash

# Update the vulnerable dependency to the patched version
npm install react-native-document-picker@9.1.1
# or with yarn
yarn add react-native-document-picker@9.1.1

# Rebuild the Android application
cd android && ./gradlew clean assembleRelease