Vulnerability · Published Dec 15, 2025 · Assigned by VulDB

CVE-2025-14702Smartbit CommV Smartschool App be.smartschool.mobile.SplashActivity path traversal

Medium 4.4

In plain English

A medium-severity path traversal in Smartschool App from Smartbit CommV. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 10% of all known vulnerabilities).

Severity (CVSS 3.1)4.4Medium

Exploit odds (30 days)0.2%top 90.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A flaw has been found in Smartbit CommV Smartschool App up to 10.4.4. Impacted is an unknown function of the component be.smartschool.mobile.SplashActivity. Executing manipulation can lead to path traversal. The attack requires local access. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products (as reported)

Vendor	Product	Versions
Smartbit CommV	Smartschool App	10.4.010.4.110.4.210.4.310.4.4

Weakness: CWE-22 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R

References

VDB-336419 | Smartbit CommV Smartschool App be.smartschool.mobile.SplashActivity path traversal vdb-entry
VDB-336419 | CTI Indicators (IOB, IOC, TTP) signature, permissions-required
Submit #706220 | Smartbit(http://www.smartschool.be/) Smartschool (be.smartschool.mobile) V10.4.4 Path Traversal third-party-advisory
https://github.com/Secsys-FDU/AF_CVEs/issues/4 exploit, issue-tracking