{"id":"CVE-2026-60117","published":"2026-11-09T18:17:29.517","lastModified":"2026-11-09T18:17:29.517","description":"The Android implementation of the Flutter/Dart receive_sharing_intent package, versions 1.4.1 through 1.9.0, contains a path traversal vulnerability in FileDirectory.getDataColumn that allows a malicious co-resident application to write files outside the intended cache directory by supplying a crafted _display_name value from an untrusted ContentProvider. Attackers can use a path-shaped display name ../databases/proof.txt combined with a controlled content stream to write to arbitrary locations within the receiving application's private sandbox under its UID, achieving file overwrite without user interaction.","cvssScore":6.2,"cvssSeverity":"MEDIUM","cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","cwes":["CWE-22"],"vendors":[],"products":[],"references":[{"url":"https://github.com/KasemJaffer/receive_sharing_intent/pull/418","tags":[]},{"url":"https://github.com/actuator/receive_sharing_intent/blob/security/contain-shared-file-cache-writes/docs/security/CWE-22-display-name-path-traversal.md","tags":[]},{"url":"https://www.vulncheck.com/advisories/receive-sharing-intent-path-traversal-via-filedirectory","tags":[]}],"exploitRefs":[{"url":"https://github.com/KasemJaffer/receive_sharing_intent/pull/418","tags":[]},{"url":"https://github.com/actuator/receive_sharing_intent/blob/security/contain-shared-file-cache-writes/docs/security/CWE-22-display-name-path-traversal.md","tags":[]}],"hasPoc":true,"ai":null}