PatchSiren

PatchSiren cyber security CVE debrief

CVE-2025-68713 Rakuten CVE debrief

CVE-2025-68713 is a vulnerability in Rakuten Send Anywhere (File Transfer) for Android (com.estmob.android.sendanywhere) version 23.2.9. The issue allows untrusted applications, with no required permissions, to force the download of arbitrary files into the app's scoped storage. These files then appear in the app's trusted Received interface. This condition can be exploited for arbitrary code execution if the downloaded payload is an APK file. Alternatively, it can lead to a denial-of-service (DoS) condition through resource exhaustion caused by oversized file transfers.

Vendor
Rakuten
Product
Send Anywhere (File Transfer) for Android
CVSS
HIGH 8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-15
Original CVE updated
2026-06-16
Advisory published
2026-06-15
Advisory updated
2026-06-16

Who should care

Users of Rakuten Send Anywhere (File Transfer) for Android version 23.2.9, administrators of networks where this app is used, and security teams responsible for managing vulnerabilities in mobile applications.

Technical summary

The vulnerability exists due to insufficient validation of file downloads within the Rakuten Send Anywhere app. Untrusted apps can exploit this by forcing downloads of arbitrary files, including potentially malicious APKs, into the app's storage. This can occur without the need for any special permissions, making it a significant risk.

Defensive priority

High

Recommended defensive actions

  • Update Rakuten Send Anywhere (File Transfer) for Android to a version that fixes this vulnerability.
  • Restrict the installation of untrusted applications on devices where Rakuten Send Anywhere is used.
  • Monitor network traffic and device logs for suspicious activity related to file downloads and app installations.
  • Consider implementing mobile device management (MDM) solutions to enforce security policies on mobile devices.

Evidence notes

The CVE record for CVE-2025-68713 was published and last modified on June 15, 2026. The vulnerability details were sourced from official CVE and NVD sources.

Sources and references

Verified primary and authoritative sources

  • CVE-2025-68713 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2025-68713

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2025-68713 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2025-68713

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.