CVE-2026-11411: Path Traversal in iAI Lab PDF AI App 4.21.0 Android

Technical summary

CVE-2026-11411 is a local path traversal vulnerability (CWE-22) in iAI Lab PDF AI App 4.21.0 running on Android. The vulnerability resides in the getExternalCacheDir function of the chatpdf.pro component. By crafting a malicious _display_name argument, an attacker can traverse directory structures and access files outside the intended application sandbox. The attack vector requires local access to the device, meaning the attacker must already have the ability to execute code or interact with the application directly. With CVSS 3.1 score of 4.4 (Medium severity), the impact is primarily integrity and availability focused rather than confidentiality.

Business impact

Organizations and individuals relying on iAI Lab PDF AI App for sensitive document processing face localized but meaningful risk. If an attacker gains local device access, they could read or modify files in unintended directories, potentially exposing cached PDF content or other application data. For enterprise deployments managing confidential documents, this vulnerability could lead to data exfiltration or tampering. The availability of public exploit code elevates urgency, as this is no longer theoretical risk. The vendor's lack of response to early disclosure creates indefinite exposure for existing installations.

Affected systems

iAI Lab PDF AI App version 4.21.0 on Android is confirmed vulnerable. The vulnerability is specific to the local attack surface; remote exploitation is not possible. Any user or device running this version is potentially affected, though exploitation requires local access. Newer versions or alternative PDF AI applications may be unaffected, but no patch information is currently available from the vendor.

Exploitability

This vulnerability is exploitable but requires local access to the Android device. An attacker must be able to run code or directly interact with the application—for example, through malware, physical device access, or compromised lateral movement within a shared system. The logical manipulation of the _display_name parameter is relatively straightforward, and public exploit code is already in circulation, removing technical barriers for opportunistic attackers. The lack of user interaction (UI:N in the CVSS vector) means the attack can proceed silently once local access is obtained.

Remediation

No vendor patch has been released. The iAI Lab development team has not responded to early disclosure efforts. Users should immediately uninstall iAI Lab PDF AI App 4.21.0 or cease use of the application if sensitive data processing is involved. Alternative PDF handling applications with active security maintenance should be evaluated and deployed. For organizations with devices running this version, consider enforcing application removal through mobile device management (MDM) policies if the application is not business-critical.

Patch guidance

Verify the latest version available on the Google Play Store or directly from the vendor. As of the vulnerability publication date (2026-06-06), no security patch has been released despite vendor notification. Recommend checking for updates regularly, but do not rely on a patch being forthcoming given the vendor's non-responsiveness. If an update does become available after this publication, review its release notes carefully to confirm the path traversal issue has been addressed before re-deploying.

Detection guidance

Monitor for unauthorized file access patterns on Android devices running iAI Lab PDF AI App 4.21.0, particularly in external cache directories and unintended file paths. On-device monitoring tools or Mobile Threat Defense (MTD) solutions may flag suspicious file system traversal attempts. Review application logs if available; however, this vulnerability is local and may not leave obvious traces. Network-based detection is limited due to the local-only attack vector. Prioritize inventory of affected devices across your organization to identify scope.

Why prioritize this

Although the CVSS score is moderate (4.4), this vulnerability merits higher-than-baseline attention due to several factors: (1) public exploit availability eliminates attack complexity, (2) the vendor's non-response creates indefinite exposure with no path to patching, (3) the application handles sensitive documents, making integrity and availability impact tangible, and (4) mobile applications are often overlooked in vulnerability management workflows, allowing affected instances to persist longer. Organizations managing sensitive PDF workflows should treat this as higher priority.

Risk score, explained

The CVSS 3.1 score of 4.4 reflects a Medium severity assessment. The score accounts for a local attack vector (AV:L), low attack complexity (AC:L), low privilege requirements (PR:L), no user interaction needed (UI:N), unchanged scope (S:U), no confidentiality impact (C:N), limited integrity impact (I:L), and limited availability impact (A:L). The moderate score does not fully capture the real-world risk introduced by public exploit availability and vendor non-responsiveness. Organizations should consider contextual factors—such as the sensitivity of documents processed and the presence of local threat actors—when setting internal remediation priorities.

Frequently asked questions