CVE-2026-18907

Path Traversal in Download File Feature in com.talpa.hibrowser 2.23.1.1 on Android allows arbitrary file write via directory traversal sequences in the filename.

Score

CVSS 3.1 7.5 High

Status

Deferred - 907edf6c-bf03-423e-ab1a-8da27e1aa1ea

Published

2026-08-05

Last modified

2026-10-23

Weaknesses

CWE-23

Affected products

• Hi Browser (Tecno Mobile)

References

• https://security.tecno.com/SRC/securityUpdates