Samsung wssyncmlnps before 2015-10-31 allows directory traversal in a Kies restore, aka ZipFury.
- https://github.com/ud2/advisories/tree/master/android/samsung/nocve-2015-0001
No PoCs found on GitHub currently.