CVE-2026-109106 | Polaris Office App 9.9.19 on Android Document Intake com.infraware.service.m.n.a _display_name path traversal

October 12, 2026 Yanac

A vulnerability was found in Polaris Office App 9.9.19 on Android. It has been declared as problematic. Affected by this vulnerability is the function com.infraware.service.m.n.a of the component Document Intake. The manipulation of the argument _display_name results in path traversal.

This vulnerability is identified as CVE-2026-109106. The attack is only possible with local access. Additionally, an exploit exists.

It is recommended to upgrade the affected component.

The vendor confirms: “We added path validation logic to ensure that files are created only within the designated temporary directory.”VulDB Recent EntriesRead More