Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.9
CVE-2026-60117: receive_sharing_intent can let other apps overwrite files
CVE-2026-60117 · published 4 days ago
Summary
The receive_sharing_intent library for Android apps (versions 1.4.1 to 1.9.0) can be fooled into saving data in the wrong place. A malicious app can supply a specially crafted name that causes the library to write files outside its own temporary folder, potentially replacing important files inside the app’s private storage. Update the library to a newer version or apply the vendor’s patch to stop this behavior.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| kasemjaffer | receive_sharing_intent | <= 1.9.0 |
Original advisory text
receive_sharing_intent 1.4.1-1.9.0 Path Traversal via FileDirectory
The Android implementation of the Flutter/Dart receive_sharing_intent package, versions 1.4.1 through 1.9.0, contains a path traversal vulnerability in FileDirectory.getDataColumn that allows a malicious co-resident application to write files outside the intended cache directory by supplying a crafted _display_name value from an untrusted ContentProvider. Attackers can use a path-shaped display name ../databases/proof.txt combined with a controlled content stream to write to arbitrary locations within the receiving application's private sandbox under its UID, achieving file overwrite without user interaction.
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Severity
6.9
Medium
Type
CWE-22Path Traversal
Timeline
Published9 Nov 2026
Updated10 Nov 2026
First seen9 Nov 2026
Track software like this
Free during beta