CVE-2024-25466

React Native Document Picker Directory Traversal vulnerability

7.8 HighPublic exploitFix available

Directory Traversal vulnerability in React Native Document Picker before v.9.1.1 and fixed in v.9.1.1 allows a local attacker to execute arbitrary code via a crafted script to the Android library component.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

0.54%Up 0.5 points since Feb 17, 2024

What each source reports

NVD Score used 7.8

Record: CVE-2024-25466
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1: 7.3 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:H
Weakness: CWE-26
Updated: 2026-11-02

CVE List 7.3

Record: CVE-2024-25466
CVSS 3.1: 7.3 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:H
Weakness: CWE-26
Updated: 2026-11-02

EUVDEUVD-2024-0687 7.3

Record: EUVD-2024-0687
CVSS 3.1: 7.3 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:H
Updated: 2026-11-03

GitHub AdvisoriesGHSA-pmgm-h3cc-m4hj 7.2

React Native Document Picker Directory Traversal vulnerability

Directory Traversal vulnerability in React Native Document Picker before 8.2.2 and 9.x before 9.1.1 allows a local attacker to execute arbitrary code via a crafted script to the Android library component.

Record: GHSA-pmgm-h3cc-m4hj
CVSS 4.0: 7.2 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.1: 7.3 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:H
Weakness: CWE-26
Updated: 2026-11-02

OSV 7.3

Record: CVE-2024-25466
CVSS 3.1: 7.3 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:H
Updated: 2026-11-02

OSVGHSA-pmgm-h3cc-m4hj 7.2

React Native Document Picker Directory Traversal vulnerability

Record: GHSA-pmgm-h3cc-m4hj
CVSS 4.0: 7.2 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.1: 7.3 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:H
Weakness: CWE-26
Updated: 2026-11-02

OSVROOT-APP-NPM-CVE-2024-25466 No score

CVE-2024-25466 in react-native-document-picker - Patched by Root

Root has patched CVE-2024-25466 in the react-native-document-picker package for Root:npm. Multiple fixed versions available.

Record: ROOT-APP-NPM-CVE-2024-25466
Updated: 2026-11-02

Affected products

react-native-documents document picker

Affected packages

Affected packages
Package	Affected	Fixed
`react-native-document-picker` npm	9.0.0 up to 9.1.1	9.1.1
`react-native-document-picker` npm	before 8.2.2	8.2.2
`react-native-document-picker` Root:npm	before 9.0.1-aikido.1	9.0.1-aikido.1
`@rootio/react-native-document-picker` Root:npm	before 9.0.1-root.io.1	9.0.1-root.io.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
PoC in GitHub	FixedOctocat/CVE-2024-25466	2024-02-15

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-25466 is a high vulnerability (CVSS 7.8) in React-native-documents Document Picker, published February 16, 2024. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 0.54%, the 45th percentile. Fixed in react-native-document-picker 9.1.1.

References

Show 4 moreShow less