CVE-2018-8909: Wire

High severity, CVSS 7.5. EPSS: 1.6% chance of exploitation in the next 30 days.

The Wire application before 2018-03-07 for Android allows attackers to write to pathnames outside of the downloads directory via a ../ in a filename of a received file, related to AssetService.scala.

Affected products

• Wire Wire: before 2018-03-07 (fixed in 2018-03-07)

Published 2018-03-22. Last modified 2026-06-17.