What’s Vulnerable › Vulnerabilities

CVE-2024-11136: Arbitrary file removal via path traversal in TCL Camera

• Severity: high (CVSS 8.2 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-11-14 · updated 2026-06-17
• Weakness: CWE-35

Description

The default TCL Camera application exposes a provider vulnerable to path traversal vulnerability. Malicious application can supply malicious URI path and delete arbitrary files from user’s external storage.

Affected products

• TCL Camera: v6.00.04.0067.3.0

References

• https://blog.oversecured.com/Content-Providers-and-the-potential-weak-spots-they-can-have/#path-traversal-when-using-data-from-uri
• https://cert.pl/en/posts/2024/11/CVE-2024-11136/
• https://cert.pl/posts/2024/11/CVE-2024-11136/

Get alerted when CVE-2024-11136 or the next vulnerability affects your stack