CVE-2026-89229 | BlueLM Copilot Path Traversal Arbitrary File Write Vulnerability
Original release date: 2026-11-03
CVE ID
CVE-2026-89229
CVSS 3.1 Base Score
5.1 Medium （AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L）
Description
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in the ShareActivity component of BlueLM Copilot (com.vivo.ai.copilot) allows a malicious application installed on the same device to write arbitrary files via a crafted ACTION_SEND intent with a ContentProvider-supplied file name containing '..' sequences.
Software Versions and Fixes
- Software Affected Version Fixed Version
- BlueLM Copilot Versions below 7.2.0.0 7.2.0.0
Temporary Fix
NA
Obtaining Fixed Software
This vulnerability is fixed in BlueLM Copilot 7.2.0.0 and later. Users can update to the latest version via the in-app update check.
Source
Anran Hou (University of Electronic Science and Technology of China); Qinsheng Hou (Shanghai Jiao Tong University); Lin Shao(University of Electronic Science and Technology of China); Liwei Guo(University of Electronic Science and Technology of China)
Update Records
2026-11-3 V1.0 INITIAL
FAQs
NA
vivo Security Procedures
vivo is committed to providing users with best cyber security products and services, and follows the industrial best practice to handle and publish vunerability information.
To report a security vulnerability in vivo products and solutions, please send it to security@vivo.com.
For details, please visit Security Advisory.
To report a security vulnerability in vivo products and solutions, please send it to security@vivo.com.
For details, please visit Security Advisory.