Read the docs
TI-2017-11222 Aliases CVE-2017-15309GHSA-39jq-p97c-g7gh

Path traversal in Huawei iReader

Priority LOW 33CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · High · Low
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA.

Summary

Huawei iReader app before 8.0.2.301 has a path traversal vulnerability due to insufficient validation on file storage paths. An attacker can exploit this vulnerability to store downloaded malicious files in an arbitrary directory.

Why it matters now

EPSS 0.00976 62nd percentileScored 2026-11-07
Fix Fixed iReader (Huawei Technologies Co., Ltd.): 8.0.2.301

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
HuaweiiReaderbefore 8.0.2.3018.0.2.301Patch availableCNA
  • iReader VendorHuawei Affected before 8.0.2.301 Fixed in 8.0.2.301 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:huawei:ireader:*:*:*:*:*:*:*:*before 8.0.2.301VulnerableHuawei
  • cpe:2.3:a:huawei:ireader:*:*:*:*:*:*:*:* Versions before 8.0.2.301 Vulnerable ·Huawei

Remediation

  • Fix · CNA iReader (Huawei Technologies Co., Ltd.) Fixed in 8.0.2.301

Timeline

  1. 2026-10-02 Threatist record created from CVE-2017-15309
  2. 2026-10-03 Alias added: GHSA-39jq-p97c-g7gh

References

Advisory 1

  • TI-2017-11221 Improper input validation in Huawei iReader CVSS 3.0HIGH 8.8
  • TI-2017-11223 Improper input validation in Huawei iReader CVSS 3.0MEDIUM 6.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences