CVE-2026-84431 Overview
CVE-2026-84431 is a path traversal vulnerability in the AirAsia MOVE mobile application for Android through version 12.47.1. The flaw resides in the com.airasia.core.utils.RealPathUtil.getRealPath function within the com.airasia.mobile component. An attacker can manipulate the _display_name argument to traverse outside the intended directory scope. Exploitation requires local access to the affected device and low-privileged application context. The exploit details are publicly available. AirAsia was contacted about the disclosure but did not respond, leaving the issue unpatched at time of publication.
Critical Impact
Local path traversal in the AirAsia MOVE Android app allows an attacker to influence file resolution logic through a crafted _display_name, potentially exposing or writing files outside the intended application directory [CWE-22].
Affected Products
- AirAsia MOVE App for Android up to and including version 12.47.1
- Component: com.airasia.mobile
- Function: com.airasia.core.utils.RealPathUtil.getRealPath
Discovery Timeline
- 2026-09-02 - CVE-2026-84431 published to NVD
- 2026-09-02 - Last updated in NVD database
Technical Details for CVE-2026-84431
Vulnerability Analysis
The vulnerability sits in the RealPathUtil.getRealPath helper of the AirAsia MOVE Android app. This utility resolves content URIs into filesystem paths, typically used when an app processes user-selected files from providers such as the media store or Storage Access Framework. The routine consumes the _display_name column value without validating or normalizing path separators. An attacker who supplies a filename containing .. sequences or absolute path fragments can influence where the app reads or writes files. Because the vulnerable code runs inside the AirAsia MOVE process, any traversal occurs with the app's own storage permissions.
Root Cause
The root cause is missing input sanitization on the _display_name value returned from content resolvers. Android content providers can return arbitrary strings for _display_name, and secure implementations must strip directory components before joining the value to a base path. RealPathUtil.getRealPath concatenates the untrusted name into a filesystem path without canonicalization, which classifies the issue as [CWE-22] Improper Limitation of a Pathname to a Restricted Directory.
Attack Vector
Exploitation requires local access. A malicious app installed on the same device, or a crafted file shared through an intent, can supply a manipulated _display_name value when interacting with AirAsia MOVE. When the app resolves the path, the traversal sequence redirects file operations to attacker-chosen locations within the AirAsia MOVE sandbox. The result is limited-scope file read or write against resources the app already has permission to access. No verified exploit code is republished here; see the VulDB advisory for CVE-2026-84431 for technical write-up references.
// No verified exploit code available.
// See VulDB #397798 and the linked technical write-up for reproduction details.
Detection Methods for CVE-2026-84431
Indicators of Compromise
- Files created or modified inside the AirAsia MOVE app sandbox with names containing ../ or absolute path fragments.
- Unexpected file access patterns from com.airasia.mobile targeting locations outside its normal cache and files directories.
- Third-party apps invoking intents against AirAsia MOVE while passing content URIs with suspicious _display_name values.
Detection Strategies
- Inspect mobile device management (MDM) telemetry for AirAsia MOVE versions at or below 12.47.1 to identify vulnerable installations.
- Use mobile threat defense tooling to flag apps that expose or consume content URIs with malformed display names.
- Review app-level logs and Android logcat captures during triage for path strings containing traversal sequences originating from RealPathUtil.
Monitoring Recommendations
- Track installed versions of AirAsia MOVE across enrolled devices and alert on any version at or below 12.47.1.
- Monitor for co-installation of untrusted apps that hold READ_EXTERNAL_STORAGE or content provider capabilities alongside AirAsia MOVE on managed devices.
- Correlate device-side file integrity findings with app inventory data in an XDR or SIEM to surface anomalous file writes attributed to the app.
How to Mitigate CVE-2026-84431
Immediate Actions Required
- Inventory managed Android devices and identify installations of AirAsia MOVE at or below version 12.47.1.
- Restrict use of the app on corporate-managed devices until a fixed release is available from the vendor.
- Advise users to avoid sharing files into AirAsia MOVE from untrusted apps or sources.
Patch Information
No vendor patch is available at time of publication. According to the VulDB entry for CVE-2026-84431, AirAsia was contacted about the disclosure but did not respond. Monitor the Google Play listing and vendor communications for a fixed release above 12.47.1.
Workarounds
- Remove AirAsia MOVE from high-value or managed devices until an updated version is released.
- Enforce mobile application management (MAM) policies that block sideloaded or untrusted apps from sharing files with AirAsia MOVE.
- Educate users to open files inside AirAsia MOVE only from trusted sources such as the platform's own downloads.
# Example: query installed version on a managed Android device via ADB
adb shell dumpsys package com.airasia.mobile | grep versionName
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.