Samsung ShortcutService Path Traversal Vulnerability Allowing Privileged File Creation

A path traversal vulnerability has been identified in the ShortcutService component of Samsung devices, affecting Android versions 14, 15, and 16, prior to the February 2026 Security Maintenance Release. This vulnerability allows a privileged local attacker to create files with system privileges by exploiting improper input validation in the ShortcutService.

Impact

Exploitation of this vulnerability could lead to unauthorized file creation with system privileges, potentially allowing for further exploitation or modification of system files.

Remediation

Users can apply the February 2026 Security Maintenance Release to address this vulnerability. This update is available through the Samsung Smart Switch application or the Samsung Members app.