CVE-2023-29736

Keyboard Themes 1.275.1.164 for Android contains a dictionary traversal vulnerability that allows unauthorized apps to overwrite arbitrary files in its…

Critical · published June 1, 2023

CVSS v3.1
9.8
EPSS
1%
Percentile
67.9
In the wild
Unconfirmed
What it is

🚨 A sneaky dictionary traversal vulnerability is lurking in Keyboard Themes 1.275.1.164 for Android! Unauthorized apps can overwrite files like a mischievous kid swapping labels on your pantry items. 🔥 Think of it as a delivery person who can break into your kitchen and replace your spices with whatever they want, all because they slipped through an unlocked door. One small action can lead to a complete overhaul of your stored recipes! The consequences here are absolutely devastating! An attacker could overwrite critical files and execute arbitrary code, potentially taking complete control of the device. Your personal data could be at risk, and the integrity of your applications is compromised.

Put simply

Think of it as a delivery person who can break into your kitchen and replace your spices with whatever they want, all because they slipped through an unlocked door. One small action can lead to a complete overhaul of your stored recipes! This vulnerability allows unauthorized apps to manipulate the file structure within the app's internal storage by exploiting a lack of proper checks on file paths, enabling them to achieve remote code execution.

What to do

The consequences here are absolutely devastating! An attacker could overwrite critical files and execute arbitrary code, potentially taking complete control of the device. Your personal data could be at risk, and the integrity of your applications is compromised. To protect your devices, immediately update Keyboard Themes to version 1.275.1.165 or above. Additionally, review your app permissions and ensure that only trusted applications have access to sensitive storage areas. Regularly audit installed apps for suspicious behavior. You’ve got this! Stay vigilant and secure your devices with these quick steps. 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01199 · 67.9th percentile
Published
2023-06-01T00:00Z
EPSS history
Timeline
  • 01 JUN 00:00Z
    Keyboard Themes 1.275.1.164 for Android contains a dictionary traversal vulnerability that allows unauthorized apps to overwrite arbitrary files in its…
    cvelistv5