CVE-2026-22070 is a path traversal flaw in OPPO ColorOS Assistant, scored 7.1 (High). The record says it has an unauthenticated start download channel that leads to file path traversal. It names no affected or fixed versions, so check the OPPO security notice and update the app through your usual channel.
What's affected
- Product: OPPO ColorOS Assistant
- Affected versions: not stated in the record
- Fixed version: not stated in the record. The OPPO security notice should say
- Attack vector: local, with user interaction required, per the CVSS vector
- Status: The CVE is not in the CISA Known Exploited Vulnerabilities catalog.
The OPPO notice page did not display content when we fetched it, so this guide rests on the CVE record. The record is short, so we do not guess at details it leaves out.
How to check if you're exposed
On an OPPO or OnePlus phone running ColorOS, open the app settings and read the version of the assistant app, then compare it with the OPPO security notice for CVE-2026-22070.
Check that automatic app and system updates are on. For fleets, look at your device management tool for devices running ColorOS and compare their versions with the notice. If you do not manage OPPO devices, this issue does not affect you.
What to do now
- Open the OPPO security notice and read the affected and fixed versions.
- Update the assistant app and the system software on each OPPO device.
- Turn on automatic updates for system apps.
- For managed fleets, list ColorOS devices and update or restrict those that cannot receive the fix.
- Install apps and files only from sources you trust until the update is in place.
Why it matters
The record files this under CWE-22, path traversal, and CWE-23, relative path traversal. A download channel that starts transfers without authentication, and that does not clean the target path, can place data in folders the app should not write to.
The vector shows a local attack with user interaction, so exploitation is not a matter of sending traffic from the internet. The scope changed, which means the impact reaches beyond the app itself.
The guidance is to read the vendor notice and update. The record gives no more detail, and we will not add detail it lacks.
Quick check
Which versions are affected?
The record does not say. Use the OPPO security notice.
Can this be exploited from the internet?
The CVSS vector lists a local attack vector and user interaction, so it does not describe a direct internet attack.
Sources
The OPPO page did not display content when fetched, so the facts here come from the CVE record.
Last reviewed: 19 October 2026.
