TickTick CVE-2026-11319

Requires a malicious application to already be installed on the same Android device as TickTick 8.2.2.0. That app must register a ContentProvider that returns a _display_name value containing path-traversal sequences and send an ACTION_SEND intent carrying a crafted content:// URI to the exported ShareReceiveActivity; the unsanitized display name flows through FileManager.getDisplayNameFromUri and AttachmentFileHelper.copyFileDirectly to produce the write. Limiting factors: exploitation is local only (no remote/network path) and requires attacker-controlled code co-resident on the device; no special TickTick configuration is needed because ShareReceiveActivity is exported by default and no user interaction or authentication within TickTick is required.

This is a genuine but moderate-priority issue, not a high-urgency emergency. The CVSS 4.0 base score of 6.9 (Medium) reflects the key constraint: AV:L means exploitation requires a malicious application already present on the same Android device - this is not a remotely reachable or network-exploitable flaw. Complexity is low (AC:L/AT:N), no privileges or user interaction are needed (PR:N/UI:N), and the impact is confined to integrity (VI:H) via arbitrary file write with TickTick's own sandbox privileges; there is no confidentiality (VC:N) or availability (VA:N) impact and no scope change to other apps. No EPSS probability was provided in the input and the CVE is not listed in CISA KEV, so there is no signal of widespread or active exploitation. A referenced GitHub repository (actuator/com.ticktick.task) strongly suggests public proof-of-concept code exists, which raises practical exploitability, but PoC availability is distinct from active exploitation. Net: the signals are internally consistent - a credible, locally-exploitable integrity flaw with likely public PoC, but gated behind the attacker first getting a malicious app onto the victim's device, making it a targeted rather than mass-exploitation threat.

A user installs a malicious or trojanized app that shares content with TickTick. That app registers a ContentProvider whose _display_name contains '../' traversal sequences and fires an ACTION_SEND intent at TickTick's exported ShareReceiveActivity, causing TickTick to copy an attacker-controlled file to an arbitrary location in its sandbox with its own privileges. Publicly available exploit code likely exists via the referenced actuator GitHub repository, and no user interaction is required because the activity is exported.