Read the docs
TI-2026-84194 Aliases CVE-2026-89229GHSA-8g37-89wr-9v3c

Path traversal in vivo BlueLM Copilot lets local apps write arbitrary files

Priority LOW 22CWE-22Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · Low · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

BlueLM Copilot (com.vivo.ai.copilot) from 0 before 7.2.0.0 is affected by a path traversal flaw (CWE-22) in its ShareActivity component. A malicious application installed on the same device can send a crafted ACTION_SEND intent with a file name containing '..' sequences, so the component writes files outside the intended directory. Exploitation requires local access and no user interaction. An attacker can write arbitrary files and has a limited effect on availability, but cannot read data.

Written with Claude Haiku 5.5 from the sources below · 2026-11-03

Description from the CNA

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in the ShareActivity component of BlueLM Copilot (com.vivo.ai.copilot) allows a malicious application installed on the same device to write arbitrary files via a crafted ACTION_SEND intent with a ContentProvider-supplied file name containing '..' sequences.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00189 8th percentileScored 2026-11-07
Fix Fixed BlueLM Copilot (vivo): 7.2.0.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
vivoBlueLM Copilotbefore 7.2.0.07.2.0.0Patch availableCNA
  • BlueLM Copilot Vendorvivo Affected before 7.2.0.0 Fixed in 7.2.0.0 Patch available CNA

Remediation

BlueLM Copilot 7.2.0.0 fixes this issue, so users should update to that version or later.

Written with Claude Haiku 5.5 from the sources below · 2026-11-03

  • Fix · CNA BlueLM Copilot (vivo) Fixed in 7.2.0.0

Timeline

  1. 2026-11-03 Threatist record created from CVE-2026-89229
  2. 2026-11-03 Alias added: GHSA-8g37-89wr-9v3c
  3. 2026-11-03 CISA SSVC decision points changed

References

Other 1

  • TI-2021-08121 Security Advisory | PendingIntent hijacking vulnerability in Framework Services CVSS 3.1CRITICAL 9.8
  • TI-2026-09964 Missing authentication in vivo PcSuite CVSS 4.0CRITICAL 9.4
  • TI-2025-14148 The SmartRemote module has insufficient restrictions on loading URLs, which may lead to some information leakage. CVSS 4.0HIGH 7.1
  • TI-2020-09981 AppStore Remote Download and Installation Vulnerability CVSS 3.1HIGH 8.2
  • TI-2017-12754 Vivo modems allow remote attackers to obtain sensitive information by reading the… CVSS 3.0HIGH 7.5
  • TI-2024-12232 MinigameCenter information leakage vulnerability CVSS 4.0MEDIUM 6.3
See all 29 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences