Skip to content
OpenAdvisories
Medium · 6.8 CVE-2026-20982 EUVD-2026-5393GHSA-fffw-cp7g-w57h

Path traversal in ShortcutService prior to SMR Feb-2026 Release 1 allows privileged local attacker to create file with system privilege.

Published Feb 4, 2026 · Updated Feb 4, 2026 · Assigned by SamsungMobile

Vendor: Samsung Mobile Product: Samsung Mobile Devices

Description

Path traversal in ShortcutService prior to SMR Feb-2026 Release 1 allows privileged local attacker to create file with system privilege.

Affected products

VendorProductAffectedFixed
Samsung Mobile Samsung Mobile Devices — SMR Feb-2026 Release in Android 14, 15, 16

Advisories 2

References