CVE-2025-14517
Yalantis uCrop AndroidManifest.xml UCropActivity improper export of android application components
LOW 1.9EPSS 0.2%
A vulnerability was determined in Yalantis uCrop 2.2.11. This affects the function UCropActivity of the file AndroidManifest.xml. Executing manipulation can lead to improper export of android application components. The attack can only be executed locally. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
- Affected
- Yalantis · uCrop
- CVSS v4.0 VULDB
- 1.9 LOW
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS v3.1 VULDB
- 5.3 MEDIUM
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L - CVSS v2.0 VULDB
- 4.3 MEDIUM
AV:L/AC:L/Au:S/C:P/I:P/A:P - EPSS
- 0.24% chance of exploitation in the next 30 days, 14th percentile
- Published
- 2025-12-11
Proof-of-concept exploits (1)
Security advisories
- https://mesquite-dream-86b.notion.site/uCrop-Library-SSRF-and-Intent-Spoofing-2b851256219…
- https://vuldb.com/?id.335855
- https://vuldb.com/?submit.702811