—score not recorded
Deep-link upload path omits external URI validation
Fixed in: 2.40.0 source tag; also present in the later 3.0.0 source release
fixed publicly
details
- Finding IDs
- F-PROTON-DRIVE-DEEPLINK-001
- Status
- fixed publicly
- Fixed in
- 2.40.0 source tag; also present in the later 3.0.0 source release
- Note
- Upload parameters received through navigation/deep-link state were accepted without applying the existing external URI guard. The 20 July 2026 update injects ValidateExternalUri into UploadToViewModel and validates every incoming URI before constructing UploadParameters. The guard rejects disallowed file URIs, including app-private paths, rather than treating incoming navigation data as trusted. The check is present in tag 2.40.0 and the later public 3.0.0 source release. The reported flow still requires the upload interaction; this entry does not claim silent exfiltration to an attacker account or verified rollout to installed Android binaries. Public-source review does not establish vendor attribution, an assigned severity or a fresh end-to-end retest.
F-PROTON-DRIVE-DEEPLINK-001: Access control. A second upload entry point bypasses URI validation already used for external inputs. Reviewed 26 Sep 2026. Mechanism assessed by 1seal.
Mechanism source for F-PROTON-DRIVE-DEEPLINK-001
Security area (1seal assessment): Authorization. A second upload entry point bypasses URI validation already used for external inputs. Reviewed 26 Sep 2026.