Read the docs
TI-2026-71552 Aliases CVE-2026-109106GHSA-hjqm-98gp-r4v8

Path traversal in Polaris Office App Document Intake

Priority MEDIUM 55CWE-22Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · Low · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

A path traversal flaw (CWE-22) in Polaris Office App 9.9.19 for Android lets a local attacker manipulate the _display_name argument in the Document Intake function com.infraware.service.m.n.a. The attack needs only local access. A public exploit has been released and may be used for attacks.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

A security flaw has been discovered in Polaris Office App 9.9.19 on Android. Affected by this vulnerability is the function com.infraware.service.m.n.a of the component Document Intake. The manipulation of the argument _display_name results in path traversal. The attack is only possible with local access. The exploit has been released to the public and may be used for attacks. Upgrading to version 9.9.22 addresses this issue. It is recommended to upgrade the affected component. The vendor confirms: "We added path validation logic to ensure that files are created only within the designated temporary directory."

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00137 3rd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix Fixed Office App (Polaris): 9.9.22

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
PolarisOffice App9.9.199.9.22Patch availableCNA
  • Office App VendorPolaris Affected 9.9.19 Fixed in 9.9.22 Patch available CNA

CPE names CNA · 1

CPEVersionsRoleVendor
cpe:2.3:a:polaris:office_app:*:*:*:*:*:*:*:*——Polaris
  • cpe:2.3:a:polaris:office_app:*:*:*:*:*:*:*:* Versions — — ·Polaris

Remediation

Upgrade Polaris Office App to version 9.9.22, which adds path validation so files are created only within the designated temporary directory.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA Office App (Polaris) Fixed in 9.9.22

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-13 Threatist record created from CVE-2026-109106
  2. 2026-10-13 Alias added: GHSA-hjqm-98gp-r4v8
  3. 2026-10-16 CISA SSVC decision points changed
  4. 2026-10-16 Priority changed: LOW → MEDIUM
  5. 2026-11-06 Affected versions changed · Red Hat
  6. 2026-11-06 CVSS score added · Red Hat

References

Exploit 1

Patch 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences