Description

A security vulnerability has been detected in Reader Tools PDF Reader App 98.8 on Android. The affected element is the function ActSplashNew.handleDeeplink of the component File Handler. The manipulation of the argument _display_name leads to path traversal. An attack has to be approached locally. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.4",
  "pubDate": "2026-09-02T20:17:42.050Z",
  "pubdate": "2026-09-02T20:17:42.050Z",
  "executiveSummary": "A path traversal vulnerability has been identified in the Reader Tools PDF Reader App version 98.8 for Android. The vulnerability resides within the File Handler component, specifically impacting the ActSplashNew.handleDeeplink function.\nThe flaw allows a local attacker to manipulate the _display_name argument to access unauthorized files within the application's sandbox or the broader filesystem, depending on existing permissions.\nThis vulnerability is classified as a path traversal (directory traversal) issue. Exploitation could lead to unauthorized file reading or information disclosure, posing a significant risk to user data privacy.\nThe attack must be executed locally on the device, requiring the attacker to interact with the vulnerable component, typically via malicious deep links or intent triggers.\nDespite early disclosure, the vendor has remained unresponsive, leaving the vulnerability unpatched in the specified version.",
  "technicalDetails": "The vulnerability exists in the ActSplashNew.handleDeeplink function within the File Handler component of the Reader Tools PDF Reader App (v98.8). The function fails to adequately sanitize the _display_name argument provided through intent-based deep linking mechanisms.\nPath traversal occurs when an application uses user-supplied input to construct a file path without sufficient validation or neutralization of directory traversal sequences, such as '../' (dot-dot-slash) characters. In this instance, by injecting these sequences into the _display_name argument, an attacker can escape the intended directory scope.\nThe exploitation flow begins when an attacker crafts a malicious intent directed at the ActSplashNew.handleDeeplink component. The intent includes the manipulated _display_name parameter containing malicious path navigation sequences. When the application processes this intent, the underlying file handling logic resolves the path relative to the application's root directory or the external storage mount point, effectively bypassing file access restrictions.\nBecause the application is running on an Android environment, the successful exploitation of this flaw allows the attacker to read files that the application process has the privilege to access. If the application has broad permissions, this could potentially expose sensitive documents, configuration files, or other user-specific data stored within the app's internal cache or shared storage areas.\nAuthentication is not required to trigger this vulnerability, as it is an interface-level flaw accessible via intent interception or malicious application invocation. The attack surface is limited to local exploitation, requiring the execution of a trigger mechanism on the target device. There are no known public patches for this specific version, and the lack of vendor response indicates that the vulnerability remains active in the current deployment.\nThe post-exploitation impact includes unauthorized information disclosure. By traversing the filesystem, an attacker can exfiltrate documents or sensitive data cached by the PDF reader, which may include proprietary or private user information. The severity is contingent upon the filesystem permissions associated with the application's UID and the specific directory structure of the Android installation."
}