Sensitive data disclosure via unsanitized file names

Path traversal in Ivanti Docs@Work for Android before 2.26.0 allows local users to read sensitive app-root data via a malicious app. The incoming-file handler trusts an attacker-controlled filename supplied by another Android app and resolves it without blocking directory traversal. A malicious app must be installed on the same device and must induce Docs@Work to process the crafted file; the reported consequence is disclosure of data in the application's private root.