{"id":"CVE-2026-107053","kind":"vulnerability","aliases":["CVE-2026-107053"],"related":[],"title":"Librera PDF Reader: insecure permissions let attackers write files outside sandbox","description":"Insecure permissions in foobnix Librera PDF Reader versionCode 7222 allows unauthorized attackers to arbitrarily write and truncate files in a shared storage space outside of the sandbox.","summary":"Librera PDF Reader versionCode 7222 has insecure permissions on shared storage. An attacker can write and truncate files outside the app's sandbox.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["android","librera-pdf-reader","other"],"not_affected_if":["no-shared-storage-access","other-versions"],"how_to_check":"- Check the installed Librera PDF Reader version code against `7222` (unknown how to read it from the device or store listing in the sources)","fix":null,"status":"open","published_at":"2026-10-29T17:17:58+00:00","first_seen_at":"2026-10-29T17:26:16+00:00","triaged_at":"2026-10-29T17:28:05+00:00","updated_at":"2026-10-29T17:28:05+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-10-29T17:28:05Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Librera PDF Reader: insecure permissions let attackers write files outside sandbox","impact":"medium","summary":"Librera PDF Reader versionCode 7222 has insecure permissions on shared storage. An attacker can write and truncate files outside the app's sandbox.","audience":"everyone","category":"other","nicknames":[],"who_cares":["android","librera-pdf-reader"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"attacker writes and truncates files in shared storage","analyst_note":"Confirm affected versions, a fixed version and attack prerequisites from the NVD entry or the vendor advisory at https://nvd.nist.gov/vuln/detail/CVE-2026-107053.","how_to_check":"- Check the installed Librera PDF Reader version code against `7222` (unknown how to read it from the device or store listing in the sources)","plain_action":"Update Librera PDF Reader to a newer version if one is available, and wait for the developer to release a fix.","needs_analyst":true,"not_affected_if":["other-versions","no-shared-storage-access"],"who_is_affected":"Android users running Librera PDF Reader versionCode 7222, where other apps or attackers on the device can write to shared storage. The sources do not say whether other versions are affected.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000664,"input_tokens":4095,"output_tokens":508,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-107053':14A,17A '-2026':13A,16A '7222':27B,54C 'allow':55C 'android':18B 'app':43B 'arbitrarili':59C 'attack':7A,35B,57C 'cve':12A,15A 'file':9A,40B,63C 'foobnix':49C 'insecur':4A,29B,46C 'let':6A 'librera':1A,20B,23B,50C 'librera-pdf-read':19B 'outsid':10A,41B,69C 'pdf':2A,21B,24B,51C 'permiss':5A,30B,47C 'reader':3A,22B,25B,52C 'sandbox':11A,45B,72C 'share':32B,66C 'space':68C 'storag':33B,67C 'truncat':39B,62C 'unauthor':56C 'versioncod':26B,53C 'write':8A,37B,60C","nicknames":[],"mitigations":[],"who_affected":"Android users running Librera PDF Reader versionCode 7222, where other apps or attackers on the device can write to shared storage. The sources do not say whether other versions are affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":"Update Librera PDF Reader to a newer version if one is available, and wait for the developer to release a fix.","first_public_at":"2026-10-29T17:17:58+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-107053","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107053","severity":null,"published_at":"2026-10-29T17:17:58+00:00","modified_at":"2026-10-29T17:17:58+00:00","first_seen_at":"2026-10-29T17:26:16+00:00","fetched_at":"2026-10-29T17:26:16+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}