CVE-2026-127209

Xiaomi Mi Browser Android Application (com.mi.globalbrowser) before 14.66.0-gn contains a path traversal vulnerability in the exported ThirdDocViewerActivity component, where CopyExternalFile.copyFromUri() copies content provider streams using an unsanitized filename from the _display_name column without basename reduction or canonical-path checks. A zero-permission co-resident malicious application can supply a crafted content provider with a _display_name containing .. sequences to make the browser write attacker-controlled bytes to an arbitrary path within its external storage directory, escaping the intended cache_docs staging location without requiring user interaction.

• CWE-22

• https://github.com/actuator/cve/blob/main/Xiaomi/2026.07.09%20CVD%20-%20Xiaomi%20Mi%20Browser.md
• https://www.vulncheck.com/advisories/xiaomi-mi-browser-path-traversal-via-thirddocvieweractivity
• https://github.com/actuator/cve/blob/main/Xiaomi/2026.07.09%20CVD%20-%20Xiaomi%20Mi%20Browser.md

Published

Nov 12, 2026

Last Modified

Nov 13, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-127202MLflow before 3.18.0 using the FileStore backend contains a …5.3
• CVE-2026-127203AppFlowy Cloud through 0.9.64 contains a stored cross-site s…5.4
• CVE-2026-127204WooCommerce PayPal Pro Payment Gateway plugin before 4.1.1 c…7.5
• CVE-2026-127206Image CAPTCHA for Contact Form 7 and WPForms through 3.3.29 …5.3
• CVE-2026-127207Sendcloud for WooCommerce through 1.0.41 contains a missing …5.4
• CVE-2026-127208datamodel-code-generator before 0.84.0 contains a code injec…8.8
• CVE-2026-12721The Kirki WordPress plugin before 6.0.13 does not properly …8.6
• CVE-2026-127211MultiVendorX plugin for WordPress before 5.0.22 contains a b…6.5
• CVE-2026-127212Dokploy before 0.31.1 contains a missing ownership check vul…4.3
• CVE-2026-12722Missing authentication for critical function vulnerability i…8.2
• CVE-2026-12723The Kirki WordPress plugin before 6.0.12 does not perform a…5.3
• CVE-2026-127235A reflected cross-site scripting vulnerability exists in the…6.1