EUVD-2026-41437
GHSA-5jfq-87w9-9824
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Requires a local co-resident malicious app (AV:L) but no privileges or interaction (PR:N/UI:N); arbitrary file overwrite gives high integrity and availability impact with no confidentiality loss.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
1DescriptionCVE.org
react-native-receive-sharing-intent contains a path traversal vulnerability that allows a co-resident malicious application to write files outside the intended cache directory by supplying a crafted _display_name value containing dot-dot path components through a malicious ContentProvider. Attackers can fire an explicit ACTION_SEND intent at the consuming app's exported share-receiver activity to overwrite arbitrary files in the consuming app's private data directory, including databases, shared preferences, and cached configuration, with attacker-controlled content.
AnalysisAI
Arbitrary file overwrite in the react-native-receive-sharing-intent library (ajith-ab) lets a co-resident malicious Android app write attacker-controlled content outside the intended cache directory into the consuming app's private data. The flaw stems from trusting a ContentProvider-supplied _display_name containing dot-dot sequences, enabling overwrite of databases, shared preferences, and cached config. Publicly available exploit code exists (reported by VulnCheck); no active exploitation has been reported in CISA KEV.
Technical ContextAI
The library provides React Native apps an Android share-target integration, resolving incoming ACTION_SEND intents and copying the referenced content into a local cache directory. To name the cached copy it queries the sending ContentProvider for the OpenableColumns _display_name value and joins it directly onto the cache path. Because the display name is fully attacker-controlled and is not sanitized or canonicalized, a value such as '../../databases/app.db' escapes the cache directory - the classic CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') root cause. Affected code is the JavaScript/Kotlin file-copy path in cpe:2.3:a:ajith-ab:react-native-receive-sharing-intent, exploitable because Android grants the receiving app write access to its own sandbox, so a traversal path resolves against the victim app's private data directory.
RemediationAI
Upstream fix available (PR/commit); released patched version not independently confirmed - apply the change from https://github.com/ajith-ab/react-native-receive-sharing-intent/pull/192 by upgrading to a build that includes it once published, or vendoring the patched file-copy logic. Because the references point to a GitHub PR rather than a tagged npm release, verify the installed version incorporates the fix rather than relying on a version number. As a compensating control in application code, sanitize the ContentProvider-supplied _display_name before use: strip path separators and dot-dot components and force the cached filename to basename only (e.g. reject or replace any name containing '/' or '..'), and write into a canonicalized cache path validated to remain within the intended directory - the trade-off is minor changes to how shared filenames are displayed. Additionally, ensure the share-receiver activity is not more broadly exported than necessary, accepting that restricting exported=true intent filters may break legitimate cross-app sharing. Reference the VulnCheck advisory for details: https://www.vulncheck.com/advisories/react-native-receive-sharing-intent-path-traversal-via-display-name.
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today