Read the docs
TI-2021-05412 Aliases CVE-2021-22440GHSA-8pgg-452j-v2w6

Path traversal in HUAWEI Mate 20;HUAWEI Mate 20…

Priority LOW 21CWE-22Published · Updated

Key facts

Attack vector
Physical
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-22 and the CVSS impact.

Summary

There is a path traversal vulnerability in some Huawei products. The vulnerability is due to that the software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly validate the pathname. Successful exploit could allow the attacker to access a location that is outside of the restricted directory by a crafted filename. Affected product versions include:HUAWEI Mate 20 9.0.0.195(C01E195R2P1), 9.1.0.139(C00E133R3P1);HUAWEI Mate 20 Pro 9.0.0.187(C432E10R1P16), 9.0.0.188(C185E10R2P1), 9.0.0.245(C10E10R2P1), 9.0.0.266(C432E10R1P16), 9.0.0.267(C636E10R2P1), 9.0.0.268(C635E12R1P16), 9.0.0.278(C185E10R2P1); Hima-L29C 9.0.0.105(C10E9R1P16), 9.0.0.105(C185E9R1P16), 9.0.0.105(C636E9R1P16); Laya-AL00EP 9.1.0.139(C786E133R3P1); OxfordS-AN00A 10.1.0.223(C00E210R5P1); Tony-AL00B 9.1.0.257(C00E222R2P1).

Why it matters now

EPSS 0.00209 11th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—HUAWEI Mate 20;HUAWEI Mate 20 Pro;Hima-L29C;Laya-AL00EP;OxfordS-AN00A;Tony-AL00B9.0.0.195(C01E195R2P1),9.1.0.139(C00E133R3P1); 9.0.0.187(C432E10R1P16),9.0.0.188(C185E10R2P1),9.0.0.245(C10E10R2P1),9.0.0.266(C432E10R1P16),9.0.0.267(C636E10R2P1),9.0.0.268(C635E12R1P16),9.0.0.278(C185E10R2P1); 9.0.0.105(C10E9R1P16),9.0.0.105(C185E9R1P16),9.0.0.105(C636E9R1P16); 9.1.0.139(C786E133R3P1); 10.1.0.223(C00E210R5P1); 9.1.0.257(C00E222R2P1)—No fix listedCNA
  • HUAWEI Mate 20;HUAWEI Mate 20 Pro;Hima-L29C;Laya-AL00EP;OxfordS-AN00A;Tony-AL00B Vendor— Affected 9.0.0.195(C01E195R2P1),9.1.0.139(C00E133R3P1); 9.0.0.187(C432E10R1P16),9.0.0.188(C185E10R2P1),9.0.0.245(C10E10R2P1),9.0.0.266(C432E10R1P16),9.0.0.267(C636E10R2P1),9.0.0.268(C635E12R1P16),9.0.0.278(C185E10R2P1); 9.0.0.105(C10E9R1P16),9.0.0.105(C185E9R1P16),9.0.0.105(C636E9R1P16); 9.1.0.139(C786E133R3P1); 10.1.0.223(C00E210R5P1); 9.1.0.257(C00E222R2P1) Fixed in — No fix listed CNA

CPE configurations NVD · 21

CPEVersionsRoleVendor
cpe:2.3:o:huawei:mate_20_firmware:9.0.0.195\(c01e195r2p1\):*:*:*:*:*:*:*9.0.0.195(c01e195r2p1)VulnerableHuawei
cpe:2.3:o:huawei:mate_20_firmware:9.1.0.139\(c00e133r3p1\):*:*:*:*:*:*:*9.1.0.139(c00e133r3p1)VulnerableHuawei
cpe:2.3:h:huawei:mate_20:-:*:*:*:*:*:*:*not specified by NVDRunning onHuawei
cpe:2.3:o:huawei:mate_20_pro_firmware:9.0.0.187\(c432e10r1p16\):*:*:*:*:*:*:*9.0.0.187(c432e10r1p16)VulnerableHuawei
cpe:2.3:o:huawei:mate_20_pro_firmware:9.0.0.188\(c185e10r2p1\):*:*:*:*:*:*:*9.0.0.188(c185e10r2p1)VulnerableHuawei
cpe:2.3:o:huawei:mate_20_pro_firmware:9.0.0.245\(c10e10r2p1\):*:*:*:*:*:*:*9.0.0.245(c10e10r2p1)VulnerableHuawei
cpe:2.3:o:huawei:mate_20_pro_firmware:9.0.0.266\(c432e10r1p16\):*:*:*:*:*:*:*9.0.0.266(c432e10r1p16)VulnerableHuawei
cpe:2.3:o:huawei:mate_20_pro_firmware:9.0.0.267\(c636e10r2p1\):*:*:*:*:*:*:*9.0.0.267(c636e10r2p1)VulnerableHuawei
cpe:2.3:o:huawei:mate_20_pro_firmware:9.0.0.268\(c635e12r1p16\):*:*:*:*:*:*:*9.0.0.268(c635e12r1p16)VulnerableHuawei
cpe:2.3:o:huawei:mate_20_pro_firmware:9.0.0.278\(c185e10r2p1\):*:*:*:*:*:*:*9.0.0.278(c185e10r2p1)VulnerableHuawei
  • cpe:2.3:o:huawei:mate_20_firmware:9.0.0.195\(c01e195r2p1\):*:*:*:*:*:*:* Versions 9.0.0.195(c01e195r2p1) Vulnerable ·Huawei
  • cpe:2.3:o:huawei:mate_20_firmware:9.1.0.139\(c00e133r3p1\):*:*:*:*:*:*:* Versions 9.1.0.139(c00e133r3p1) Vulnerable ·Huawei
  • cpe:2.3:h:huawei:mate_20:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
  • cpe:2.3:o:huawei:mate_20_pro_firmware:9.0.0.187\(c432e10r1p16\):*:*:*:*:*:*:* Versions 9.0.0.187(c432e10r1p16) Vulnerable ·Huawei
  • cpe:2.3:o:huawei:mate_20_pro_firmware:9.0.0.188\(c185e10r2p1\):*:*:*:*:*:*:* Versions 9.0.0.188(c185e10r2p1) Vulnerable ·Huawei
  • cpe:2.3:o:huawei:mate_20_pro_firmware:9.0.0.245\(c10e10r2p1\):*:*:*:*:*:*:* Versions 9.0.0.245(c10e10r2p1) Vulnerable ·Huawei
  • cpe:2.3:o:huawei:mate_20_pro_firmware:9.0.0.266\(c432e10r1p16\):*:*:*:*:*:*:* Versions 9.0.0.266(c432e10r1p16) Vulnerable ·Huawei
  • cpe:2.3:o:huawei:mate_20_pro_firmware:9.0.0.267\(c636e10r2p1\):*:*:*:*:*:*:* Versions 9.0.0.267(c636e10r2p1) Vulnerable ·Huawei
  • cpe:2.3:o:huawei:mate_20_pro_firmware:9.0.0.268\(c635e12r1p16\):*:*:*:*:*:*:* Versions 9.0.0.268(c635e12r1p16) Vulnerable ·Huawei
  • cpe:2.3:o:huawei:mate_20_pro_firmware:9.0.0.278\(c185e10r2p1\):*:*:*:*:*:*:* Versions 9.0.0.278(c185e10r2p1) Vulnerable ·Huawei
Show 11 more CPE
CPEVersionsRoleVendor
cpe:2.3:h:huawei:mate_20_pro:-:*:*:*:*:*:*:*not specified by NVDRunning onHuawei
cpe:2.3:o:huawei:hima-l29c_firmware:9.0.0.105\(c10e9r1p16\):*:*:*:*:*:*:*9.0.0.105(c10e9r1p16)VulnerableHuawei
cpe:2.3:o:huawei:hima-l29c_firmware:9.0.0.105\(c185e9r1p16\):*:*:*:*:*:*:*9.0.0.105(c185e9r1p16)VulnerableHuawei
cpe:2.3:o:huawei:hima-l29c_firmware:9.0.0.105\(c636e9r1p16\):*:*:*:*:*:*:*9.0.0.105(c636e9r1p16)VulnerableHuawei
cpe:2.3:h:huawei:hima-l29c:-:*:*:*:*:*:*:*not specified by NVDRunning onHuawei
cpe:2.3:o:huawei:laya-al00ep_firmware:9.1.0.139\(c786e133r3p1\):*:*:*:*:*:*:*9.1.0.139(c786e133r3p1)VulnerableHuawei
cpe:2.3:h:huawei:laya-al00ep:-:*:*:*:*:*:*:*not specified by NVDRunning onHuawei
cpe:2.3:o:huawei:oxfords-an00a_firmware:10.1.0.223\(c00e210r5p1\):*:*:*:*:*:*:*10.1.0.223(c00e210r5p1)VulnerableHuawei
cpe:2.3:h:huawei:oxfords-an00a:-:*:*:*:*:*:*:*not specified by NVDRunning onHuawei
cpe:2.3:o:huawei:tony-al00b_firmware:9.1.0.257\(c00e222r2p1\):*:*:*:*:*:*:*9.1.0.257(c00e222r2p1)VulnerableHuawei
cpe:2.3:h:huawei:tony-al00b:-:*:*:*:*:*:*:*not specified by NVDRunning onHuawei
  • cpe:2.3:h:huawei:mate_20_pro:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
  • cpe:2.3:o:huawei:hima-l29c_firmware:9.0.0.105\(c10e9r1p16\):*:*:*:*:*:*:* Versions 9.0.0.105(c10e9r1p16) Vulnerable ·Huawei
  • cpe:2.3:o:huawei:hima-l29c_firmware:9.0.0.105\(c185e9r1p16\):*:*:*:*:*:*:* Versions 9.0.0.105(c185e9r1p16) Vulnerable ·Huawei
  • cpe:2.3:o:huawei:hima-l29c_firmware:9.0.0.105\(c636e9r1p16\):*:*:*:*:*:*:* Versions 9.0.0.105(c636e9r1p16) Vulnerable ·Huawei
  • cpe:2.3:h:huawei:hima-l29c:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
  • cpe:2.3:o:huawei:laya-al00ep_firmware:9.1.0.139\(c786e133r3p1\):*:*:*:*:*:*:* Versions 9.1.0.139(c786e133r3p1) Vulnerable ·Huawei
  • cpe:2.3:h:huawei:laya-al00ep:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
  • cpe:2.3:o:huawei:oxfords-an00a_firmware:10.1.0.223\(c00e210r5p1\):*:*:*:*:*:*:* Versions 10.1.0.223(c00e210r5p1) Vulnerable ·Huawei
  • cpe:2.3:h:huawei:oxfords-an00a:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
  • cpe:2.3:o:huawei:tony-al00b_firmware:9.1.0.257\(c00e222r2p1\):*:*:*:*:*:*:* Versions 9.1.0.257(c00e222r2p1) Vulnerable ·Huawei
  • cpe:2.3:h:huawei:tony-al00b:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-22440
  2. 2026-10-03 Alias added: GHSA-8pgg-452j-v2w6

References

Advisory 1

  • TI-2019-06941 Cryptographic flaw in Bluetooth BR/EDR CVSS 3.1HIGH 8.1
  • TI-2020-07388 Buffer overflow in Huawei HONOR 20 PRO CVSS 3.1HIGH 7.8
  • TI-2019-03711 Double free in Emily-AL00A, Emily-TL00B, Emily-L09C, Emily-L29C CVSS 3.1HIGH 7.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences