CVE-2026-109106 Polaris CVE debrief

Who should care

Android users and administrators who use Polaris Office App 9.9.19 should assess their exposure and apply the patch. IT teams responsible for managing Android applications in their organization should prioritize patching.

Why it matters

CVE-2026-109106 is a medium-severity path traversal vulnerability in Polaris Office App 9.9.19 on Android. Local attackers can exploit this issue to potentially access or create unauthorized files. The vendor has addressed this issue in version 9.9.22. Android users and administrators should assess their exposure, apply the patch, and verify the app version to ensure mitigation.

• Local attackers may access or create unauthorized files
• Patching to version 9.9.22 or later is required to address the vulnerability
• Verification of the app version is necessary to ensure mitigation

Technical summary

The Polaris Office App 9.9.19 on Android is vulnerable to a path traversal attack due to improper handling of the _display_name argument in the com.infraware.service.m.n.a function of the Document Intake component. This vulnerability allows local attackers to potentially access or create files outside the intended directory. The issue has been addressed in version 9.9.22 by adding path validation logic to ensure files are created only within a designated temporary directory. Android users and administrators should assess their exposure, apply the patch, and verify the app version to ensure mitigation.

Defensive priority

Medium-priority patching and verification recommended for Polaris Office App installations

Recommended defensive actions

• Apply the vendor-provided patch by upgrading to Polaris Office App version 9.9.22 or later
• Verify that the Polaris Office App is updated to version 9.9.22 or later
• Monitor local access to the affected component and restrict it if possible
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the vulnerability, its impact, and the vendor's response. Additional information on potential exploits or affected systems is limited. Defenders should verify the app version and assess local access to the affected component. The exploit has been publicly disclosed, and patching to version 9.9.22 or later is recommended. However, specific details about the vulnerability's impact on various systems and potential attack vectors are not provided in the available sources.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.