Description
ColorOS Assistant has an unauthenticated start-download channel, leading to file path traversal.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| OPPO | ColorOS Assistant | — | 1.4.26 |
High · 7.1
CVE-2026-22070
EUVD-2026-26354GHSA-p7qv-vx32-p4gg
ColorOS Assistant Path Traversal Vulnerability
Published Apr 30, 2026 · Updated Apr 30, 2026 · Assigned by OPPO