CVE-2026-89229

BlueLM Copilot shared-file names can escape the intended directory

vivo · BlueLM Copilot Android ShareActivity

First documented disclosure · Review checkpoint

Summary

A malicious app on the same device can write outside the intended shared-file directory.

Severity and exploitation evidence

Medium · 5.1/10 · CVSS 4.0. Severity source.

Exploitation not established: Malicious exploitation is not established by the reviewed primary sources.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

ShareActivity accepts traversal sequences in a ContentProvider file name supplied with an Android sharing intent.

Conditions required

A malicious application must already be installed locally; this is not an unauthenticated internet attack.

Potential impact

File tampering or denial of service within reachable writable locations. Privilege escalation is not demonstrated by the reviewed sources.

Affected versions and configurations

Versions below 7.2.0.0.

Fix and mitigation status

7.2.0.0, according to vivo.

Practical next steps

Update BlueLM Copilot through its in-app updater to a current release containing the 7.2.0.0 fix. Review untrusted applications installed alongside it.

Operating lesson

Treat names supplied by other apps as untrusted data before selecting a write destination.

Evidence and limits

The CNA labels its 5.1 score CVSS 4.0; vivo’s bulletin labels a 5.1 vector CVSS 3.1. This register shows the CNA version without merging the two. No observed victim compromise is reported in these sources.

Sources