CVE-2026-11411 Overview
CVE-2026-11411 is a path traversal vulnerability [CWE-22] affecting iAI Lab PDF AI App version 4.21.0 on Android. The flaw resides in the getExternalCacheDir function of the chatpdf.pro component. An attacker with local access can manipulate the _display_name argument to traverse outside the intended directory structure. According to VulDB, the exploit has been released publicly and may be used in attacks. The vendor was contacted prior to disclosure but did not respond.
Critical Impact
Local attackers can leverage manipulation of the _display_name parameter to read or write files outside the app's intended cache directory, affecting confidentiality and integrity of stored data.
Affected Products
- iAI Lab PDF AI App 4.21.0 (Android)
- Component: chatpdf.pro
- Affected function: getExternalCacheDir
Discovery Timeline
- 2026-06-06 - CVE-2026-11411 published to NVD
- 2026-06-08 - Last updated in NVD database
Technical Details for CVE-2026-11411
Vulnerability Analysis
The vulnerability is a path traversal flaw [CWE-22] in the Android PDF AI App produced by iAI Lab. The affected logic invokes getExternalCacheDir within the chatpdf.pro component and constructs a file path using the user-supplied _display_name argument. Because the application does not validate or canonicalize the supplied value, an attacker can submit traversal sequences such as ../ to escape the cache directory. The result is read or write access to file system locations the app should not be able to touch under its own permissions. EPSS data places the probability of exploitation in the wild low, but a public exploit reportedly exists.
Root Cause
The root cause is insufficient sanitization of the _display_name input before it is concatenated into a file path returned from getExternalCacheDir. The function trusts caller-supplied data to designate a file name within the external cache directory. Without canonicalization or rejection of directory separator sequences, the path resolves to attacker-controlled locations.
Attack Vector
Exploitation requires local access on the Android device, typically via a malicious app or a component that can deliver a crafted intent or content URI to the vulnerable handler. The attacker supplies a _display_name value containing traversal characters. The vulnerable component then resolves the path outside the intended cache directory, enabling limited file read or write within the app's permission scope. The CVSS 4.0 vector indicates local attack vector, low complexity, low privileges required, and no user interaction.
No verified proof-of-concept code is published in this advisory. Technical details are tracked in the GitHub project repository and the VulDB CVE Details record.
Detection Methods for CVE-2026-11411
Indicators of Compromise
- File system artifacts created outside the application's external cache directory, particularly files containing path traversal sequences in their original request name.
- Unexpected modifications to files within the iAI Lab PDF AI App data sandbox at runtime.
- Inbound intents or content provider calls to chatpdf.pro containing ../ sequences in _display_name.
Detection Strategies
- Inspect Android logs for entries from the chatpdf.pro component referencing _display_name values that contain .., encoded separators, or absolute path prefixes.
- Use static analysis on installed APKs to identify untrusted input flowing into getExternalCacheDir based path construction.
- Monitor mobile threat defense telemetry for apps writing to paths outside their expected sandbox directories.
Monitoring Recommendations
- Track installations of iAI Lab PDF AI App version 4.21.0 across managed devices using mobile device management (MDM) inventory.
- Alert on intents or implicit broadcasts targeting chatpdf.pro from untrusted sources.
- Correlate file write events in external storage paths with the originating package signature.
How to Mitigate CVE-2026-11411
Immediate Actions Required
- Uninstall or block iAI Lab PDF AI App version 4.21.0 from managed Android devices until a vendor fix is published.
- Restrict sideloaded application installation through MDM policy to limit local attacker positioning.
- Audit devices for the presence of the affected package and any suspicious co-installed apps that may target it.
Patch Information
No vendor patch is available. According to the advisory, the vendor was contacted prior to disclosure but did not respond. Track the VulDB Vulnerability Overview for updates on remediation status.
Workarounds
- Remove the affected application from devices that process sensitive data.
- Disable or revoke storage permissions for the app where removal is not possible, reducing the impact of traversal writes.
- Prevent installation of untrusted third-party apps that could deliver crafted intents to chatpdf.pro.
- Educate users to avoid installing the affected version until a fixed release is published.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
