Local file overwrite via unvalidated import display name

Path traversal in AI Photo Team Galleryit 1.3.8.2 allows local users to overwrite internal app files through a crafted file import. GalleryWelcomeActivity1 trusts the _display_name returned by an attacker-controlled content provider and uses traversal segments while copying the supplied content into internal storage. A malicious Android app must be opened on the same device; it can then launch a VIEW intent without further interaction to corrupt configuration or stop the app from launching, while code execution depends on overwriting an executable or security-sensitive file.