EUVD-2026-52442
GHSA-fmx4-2vwr-8cfw
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local-only attack vector and low-privilege requirement per description; all impacts low as traversal grants partial file access, not full system compromise.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability was detected in Blix Email Blue Mail Calendar App 2.2.305. Impacted is the function FileDirectory.getDataColumn/FileDirectory.getFileFromUri of the component react-native-receive-sharing-intent. The manipulation of the argument _display_name results in path traversal. The attack is only possible with local access. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Path traversal in Blix Email Blue Mail Calendar App 2.2.305 exposes the device filesystem to local attackers via the react-native-receive-sharing-intent component. The functions FileDirectory.getDataColumn and FileDirectory.getFileFromUri fail to sanitize the _display_name argument, allowing traversal sequences to escape the app's intended directory scope and access or overwrite arbitrary files reachable by the app's process. No active exploitation is confirmed in CISA KEV, though a public proof-of-concept is available on GitHub and the vendor did not respond to coordinated disclosure, leaving no official patch available.
Technical ContextAI
Blue Mail is a mobile email and calendar application developed by Blix, identified by CPE cpe:2.3:a:blix:email_blue_mail_calendar_app:*:*:*:*:*:*:*:*. The vulnerable code resides in the react-native-receive-sharing-intent library - a React Native module that handles Android share intents from other apps. When an external app shares a file to Blue Mail, the library resolves the file path using the _display_name field from the content provider without stripping or normalizing path traversal sequences (e.g., '../'). This is a classic CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) flaw: user-controlled input is used directly in filesystem operations without boundary enforcement, enabling reads or writes outside the application's sandboxed storage area.
RemediationAI
No vendor-released patch is available at time of analysis - Blix did not respond to the vulnerability disclosure, leaving no official fix version confirmed. As an immediate compensating control, users and administrators should revoke or restrict the app's file storage permissions on Android (Settings > Apps > Blue Mail > Permissions), which limits the blast radius of any traversal to files the app can legitimately access. Organizations with MDM solutions should consider blocklisting or restricting the sharing of untrusted content to Blue Mail until a patch is issued. Monitoring Android audit logs for unexpected file access by the Blue Mail process (me.bluemail.mail) can provide detection capability. If the application is not critical to operations, uninstalling it is the most effective control. Users should monitor VulDB entry https://vuldb.com/vuln/385567 for patch availability updates.
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today