Description

A vulnerability was detected in AirAsia MOVE App up to 12.47.1 on Android. This issue affects the function com.airasia.core.utils.RealPathUtil.getRealPath of the component com.airasia.mobile. Performing a manipulation of the argument _display_name results in path traversal. The attack requires a local approach. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.4",
  "pubDate": "2026-09-02T02:17:19.900Z",
  "pubdate": "2026-09-02T02:17:19.900Z",
  "executiveSummary": "A path traversal vulnerability exists in the AirAsia MOVE App for Android, specifically within the com.airasia.mobile component.\nThe vulnerability originates from insufficient input validation of the _display_name argument processed by the com.airasia.core.utils.RealPathUtil.getRealPath function.\nBy manipulating this argument, an attacker with local access can perform path traversal, potentially accessing or manipulating files outside of the intended directory structure.\nThis vulnerability affects versions up to 12.47.1. Because the exploit is public and the vendor has not responded, the risk of exploitation is elevated.\nSuccessful exploitation requires local access to the device. An attacker could leverage this vulnerability to gain unauthorized access to sensitive application data or escalate privileges depending on the app's file system permissions.",
  "technicalDetails": "The vulnerability resides within the com.airasia.core.utils.RealPathUtil.getRealPath method, which is responsible for resolving file paths from URI inputs in the com.airasia.mobile component.\nThe root cause is an improper sanitization of user-supplied input, specifically the _display_name parameter, before using it in file system operations. When the application processes file selection or URI resolution, it fails to sufficiently validate the input against path traversal sequences (e.g., '../').\nAn attacker can exploit this by crafting a malicious payload within the _display_name argument, injecting traversal sequences that force the application to resolve to an unauthorized file path on the device's storage.\nThe attack flow proceeds as follows: First, the attacker identifies a mechanism within the application that triggers the call to getRealPath with a manipulatable _display_name. Second, the attacker submits a specially crafted URI or intent where the _display_name contains sequences like '../' to escape the intended directory sandbox. Third, the getRealPath function fails to neutralize these sequences, allowing the underlying file operations to reference arbitrary files accessible to the application's context.\nThis vulnerability is classified as a local attack vector, meaning an attacker must have physical access to the device or the ability to execute code locally (e.g., via another malicious app or a compromised process) to trigger the vulnerable functionality. Since the application likely runs within a specific UID on Android, the post-exploitation impact is constrained by that UID's permissions. However, if the target file is readable by the application's user, the attacker can extract sensitive application data, configuration files, or local tokens.\nGiven that the exploit is public, the barrier to entry for potential attackers is significantly lowered. The absence of a response from the vendor means this path traversal remains unpatched in the specified versions, necessitating alternative defensive measures to restrict the application's ability to access sensitive files."
}