CVE-2025-65814
📋 TL;DR
CVE-2025-65814 is a directory traversal vulnerability in RHOPHI Analytics LLP Office App-Edit Word v6.4.1 that allows attackers to access files outside the intended directory through the file import process. This affects all users of the vulnerable Android application version who process untrusted files.
💻 Affected Systems
- RHOPHI Analytics LLP Office App-Edit Word
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could read sensitive system files, extract credentials, or potentially write malicious files to execute arbitrary code with app permissions.
Likely Case
Unauthorized access to application data, configuration files, or other user documents stored on the device.
If Mitigated
Limited to accessing only files within the app's sandbox if proper input validation and path sanitization are implemented.
🎯 Exploit Status
Exploitation requires user interaction to import a malicious file, but the directory traversal technique itself is straightforward.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: No
Instructions:
1. Monitor Google Play Store for app updates. 2. Update to the latest version when available. 3. Verify the update addresses CWE-22 vulnerabilities.
🔧 Temporary Workarounds
Disable file import functionality
androidPrevent users from importing files into the application
Use alternative office applications
androidSwitch to trusted office applications with proper security controls
🧯 If You Can't Patch
- Restrict app permissions to minimal required access
- Educate users about risks of importing untrusted files
🔍 How to Verify
Check if Vulnerable:
Check app version in Android Settings > Apps > Office App-Edit Word > App infoCheck Version:
adb shell dumpsys package com.rhopi.office | grep versionNameVerify Fix Applied:
Verify app version is newer than v6.4.1 and test file import with path traversal payloads📡 Detection & Monitoring
Log Indicators:
- Unusual file access patterns
- Failed path validation attempts
- Access to files outside app sandbox
Network Indicators:
- File downloads from untrusted sources followed by app file imports
SIEM Query:
app:"Office App-Edit Word" AND (event:"file_access" OR event:"import") AND path:"../"