CVE-2025-48567
Published: 02 March 2026
Summary
CVE-2025-48567 is a high-severity Path Traversal (CWE-22) vulnerability in Google Android. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 0.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-48567 is a vulnerability in Android that allows bypassing a file path filter designed to prevent access to sensitive directories. The issue stems from incorrect Unicode normalization occurring in multiple locations within the software. It is classified under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) and has a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
A local attacker requires no additional execution privileges to exploit this vulnerability but needs user interaction to trigger it. By leveraging the Unicode normalization flaw, the attacker can circumvent path restrictions, gaining unauthorized access to sensitive directories and achieving local escalation of privilege with high impacts on confidentiality, integrity, and availability.
The Android security bulletin published on March 1, 2026, at https://source.android.com/docs/security/bulletin/2026/2026-03-01 details patches and mitigation guidance for this CVE. Security practitioners should consult the advisory for affected versions and remediation steps.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-208198
Vulnerability details
In multiple locations, there is a possible bypass of a file path filter designed to prevent access to sensitive directories due to incorrect unicode normalization. This could lead to local escalation of privilege with no additional execution privileges needed. User…
more
interaction is needed for exploitation.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct local path traversal bypass via Unicode normalization flaw enables unauthorized access to restricted directories, resulting in privilege escalation as explicitly described.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Ensures file path inputs undergo proper validation and normalization to block traversal attacks exploiting Unicode discrepancies.
Mandates timely identification, reporting, and correction of flaws like incorrect Unicode normalization in path filters.
Enforces logical access controls to sensitive directories, providing a secondary barrier against path filter bypasses.