CVE-2025-68713: Rakuten Send Anywhere Android Arbitrary File Download & Code Execution Vulnerability

Technical summary

CVE-2025-68713 is a privilege escalation and code execution vulnerability in Send Anywhere for Android (version 23.2.9). The flaw stems from insufficient validation of file download requests, categorized under CWE-926 (Implicit Trust in Execution Environment). An unprivileged application can programmatically trigger arbitrary file downloads directly into Send Anywhere's app-specific scoped storage directory without requiring file system permissions. The downloaded files are subsequently indexed by the app's content interface and presented to the user as legitimately received transfers, bypassing the app's normal peer-to-peer authentication and integrity checks. This mechanism creates both code execution risk (via APK delivery) and availability risk (via resource exhaustion).

Business impact

For enterprise users relying on Send Anywhere for secure file sharing, this vulnerability undermines trust in the received file interface and creates a backdoor for APK injection attacks. An attacker with access to a user's device—or another app installed on it—can deliver malware disguised as incoming transfers, increasing the likelihood of successful installation. Additionally, an attacker can trigger denial-of-service conditions by forcing enormous downloads that exhaust storage and device resources, disrupting productivity. Organizations should assume that users cannot reliably distinguish between legitimately received files and injected ones without additional out-of-band verification.

Affected systems

Rakuten Send Anywhere (File Transfer) for Android application version 23.2.9 is confirmed affected. The vulnerability requires the vulnerable app to be installed on an Android device; exploitation does not require the attacker app to have declared file access permissions, lowering the barrier to attack. The scope is limited to Android; iOS and desktop versions are not mentioned as affected.

Exploitability

The attack requires low privilege (an attacker-controlled or compromised app on the same device, or sideloaded malicious APK) and user interaction (the user must then open and potentially install or trust files from the Received section). The network is reachable, and exploit complexity is low—triggering a download is a straightforward inter-process communication or API call. CVSS 3.1 score of 8 (HIGH) reflects the combination of high confidentiality and integrity impact (code execution via APK) and high availability impact (DoS). Real-world exploitation is feasible for device-resident threats or supply-chain attacks on pre-installed malware.

Remediation

Users must update Rakuten Send Anywhere to a version newer than 23.2.9; verify the available patch version against the official Google Play Store or Rakuten's security advisories. The remediation should validate file download requests, enforce app-to-app authentication, and restrict write access to scoped storage only to legitimate peer-to-peer transfers. Users who cannot update immediately should disable or uninstall the app if file sharing is not critical, or install only from trusted sources and avoid granting broad device access to other applications.

Patch guidance

Check the Google Play Store or Rakuten's official security advisory for the earliest version after 23.2.9 that addresses this vulnerability. Apply the patch as soon as it becomes available. Verify successful installation by confirming the app version number in Settings > Apps. Consider using Mobile Device Management (MDM) policies to enforce automatic updates for Send Anywhere across your organization. Test the patched version in a non-production environment first if your workflow depends on Send Anywhere.

Detection guidance

Monitor for unexpected file downloads into Send Anywhere's cache or data directory using Mobile Threat Defense (MTD) solutions or device-level file system auditing. Flag instances of unsigned APK files appearing in the app's Received folder, especially if no corresponding peer-to-peer transfer session was initiated by the user. Review Android application logs (via adb logcat) for inter-process communication (IPC) calls targeting Send Anywhere's content providers from unexpected sources. On enterprise devices, use MDM to query installed app versions and alert if Send Anywhere version 23.2.9 is detected.

Why prioritize this

This vulnerability merits immediate attention due to its HIGH CVSS score, the potential for arbitrary code execution (APK injection), and the low barrier to exploitation (unprivileged attacker app). Users and organizations depend on file transfer apps to securely exchange data; a compromised trust boundary in the received file interface poses significant risk. The attack surface includes any device with Send Anywhere installed and another app (legitimate or malicious) already present. Prioritize patching for users in high-risk roles or those who regularly receive and install files from Send Anywhere.

Risk score, explained

CVSS 3.1 score of 8 is justified by: (1) Attack Vector: Network (the attacker can be remote and leverage a local app as a proxy); (2) Attack Complexity: Low (no special conditions needed); (3) Privileges Required: Low (unprivileged app); (4) User Interaction: Required (user must open or interact with the injected file); (5) Impact: High across Confidentiality, Integrity, and Availability (code execution + DoS). The combination of code execution potential and low complexity elevates this to HIGH severity despite the user interaction requirement.

Frequently asked questions