---
id: CVE-2025-68713
title: >-
  An issue was discovered in Rakuten Send Anywhere (File Transfer) for Android
  (com.estmob.android.sendanywhere) 23.2.9
summary: >-
  An issue was discovered in Rakuten Send Anywhere (File Transfer) for Android
  (com.estmob.android.sendanywhere) 23.2.9. The vulnerability allows untrusted
  applications (with no permissions) to force arbitrary file downloads into the
  app's…
severity: high
cvss: 8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H'
cwe:
  - CWE-926
published: '2026-06-15'
updated: '2026-10-12'
sourceUpdated: '2026-10-12T22:10:00.247'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-68713'
references:
  - url: >-
      https://github.com/actuator/com.estmob.android.sendanywhere/blob/main/CVE-2025-68713
    label: cve@mitre.org
tags:
  - nvd
epss: 0.00284
epssPercentile: 0.19265
ingestedAt: '2026-10-12T23:07:25.615Z'
---

## Overview

An issue was discovered in Rakuten Send Anywhere (File Transfer) for Android (com.estmob.android.sendanywhere) 23.2.9. The vulnerability allows untrusted applications (with no permissions) to force arbitrary file downloads into the app's scoped storage. The resulting files appear in the application's trusted Received interface. These conditions establish a vector for arbitrary code execution if the payload is an APK file, or a denial-of-service condition through resource exhaustion from oversized transfers.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.