Read the docs
TI-2026-69244 Aliases CVE-2026-101886GHSA-f4x7-43cf-cc2j

Path traversal in Cisco Jabber for Android lets apps write files

Priority LOW 22CWE-22Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Cisco Jabber for Android before 15.3.1.311364 contains a path traversal flaw (CWE-22). A display name taken from a content provider is not sanitized before it is used in a file path, so a malicious app with no permissions can write attacker-controlled files into Jabber's private data directory without user interaction. The flaw affects integrity only, with no confidentiality or availability impact.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

Cisco Jabber for Android (com.cisco.im) before 15.3.1.311364 contains a path traversal vulnerability that allows a malicious app with no permissions to write attacker-controlled files into Jabber's private data directory by exploiting the exported crosslaunch.share activity and an unsanitized display name from a ContentProvider used in file path construction. Attackers can craft a shared content:// URI with a display name containing '../' sequences to place fully attacker-controlled content within directories such as databases/, shared_prefs/, no_backup/, and files/ without user interaction.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0014 3rd percentileScored 2026-11-07
Fix Fixed Jabber for Android (Cisco): 15.3.1.311364

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
CiscoJabber for Androidbefore 15.3.1.31136415.3.1.311364Patch availableCNA
  • Jabber for Android VendorCisco Affected before 15.3.1.311364 Fixed in 15.3.1.311364 Patch available CNA

Remediation

Upgrade Cisco Jabber for Android to version 15.3.1.311364, which is the fixed version.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA Jabber for Android (Cisco) Fixed in 15.3.1.311364

Timeline

  1. 2026-10-07 Threatist record created from CVE-2026-101886
  2. 2026-10-07 Alias added: GHSA-f4x7-43cf-cc2j
  3. 2026-10-10 CISA SSVC decision points changed

References

Advisory 1

Other 1

  • TI-2026-74174 Arbitrary file write in Cisco Secure Email Gateway via AMP feature KEVCVSS 3.1CRITICAL 9.8
  • TI-2026-53490 Cisco Catalyst SD-WAN Manager System Account Authorization Bypass Vulnerability KEVCVSS 3.1CRITICAL 9.8
  • TI-2026-53489 Cisco Secure Email Gateway SQL Injection Vulnerability KEVCVSS 3.1CRITICAL 9.8
  • TI-2026-53488 Cisco Identity Services Engine Authentication Bypass Vulnerability KEVCVSS 3.1CRITICAL 10.0
  • TI-2026-16388 Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability KEVCVSS 3.1CRITICAL 10.0
  • TI-2026-16344 Cisco Secure Firewall Management Center Software Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 10.0
See all 7059 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences