Skip to main content

react-native-receive-sharing-intent CVE-2026-58460

| EUVDEUVD-2026-41437 HIGH
Path Traversal (CWE-22)
2026-07-02 VulnCheck GHSA-5jfq-87w9-9824
Path Traversal React Native Receive Sharing Intent
7.0
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
7.0 HIGH
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
7.7 HIGH

Requires a local co-resident malicious app (AV:L) but no privileges or interaction (PR:N/UI:N); arbitrary file overwrite gives high integrity and availability impact with no confidentiality loss.

3.1 AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
4.0 AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

1
Analysis Generated
Jul 02, 2026 - 21:23 vuln.today

DescriptionCVE.org

react-native-receive-sharing-intent contains a path traversal vulnerability that allows a co-resident malicious application to write files outside the intended cache directory by supplying a crafted _display_name value containing dot-dot path components through a malicious ContentProvider. Attackers can fire an explicit ACTION_SEND intent at the consuming app's exported share-receiver activity to overwrite arbitrary files in the consuming app's private data directory, including databases, shared preferences, and cached configuration, with attacker-controlled content.

AnalysisAI

Arbitrary file overwrite in the react-native-receive-sharing-intent library (ajith-ab) lets a co-resident malicious Android app write attacker-controlled content outside the intended cache directory into the consuming app's private data. The flaw stems from trusting a ContentProvider-supplied _display_name containing dot-dot sequences, enabling overwrite of databases, shared preferences, and cached config. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Install malicious co-resident app
Delivery
Register malicious ContentProvider with crafted _display_name
Exploit
Fire explicit ACTION_SEND at exported share activity
Execution
Library joins dot-dot name onto cache path
Persist
Write attacker content outside cache
Impact
Overwrite victim private databases/prefs
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Requires a second attacker-controlled application co-resident on the same Android device and the victim app must integrate react-native-receive-sharing-intent with an exported share-receiver activity that accepts ACTION_SEND intents (the default integration pattern). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:N, VC:N/VI:H/VA:H, score 7.0) frames this as a local, low-complexity, no-privilege, no-interaction attack with high integrity and availability impact and no confidentiality loss - consistent with an on-device malicious app overwriting files rather than reading them. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario A user installs both a legitimate app that uses react-native-receive-sharing-intent and an attacker's app; the attacker's app fires an explicit ACTION_SEND intent at the victim's exported share-receiver activity, backing the shared item with a malicious ContentProvider that returns a _display_name like '../databases/users.db'. The library copies attacker content to that traversal path, overwriting the victim app's database or shared preferences with attacker-controlled data. …
Remediation Upstream fix available (PR/commit); released patched version not independently confirmed - apply the change from https://github.com/ajith-ab/react-native-receive-sharing-intent/pull/192 by upgrading to a build that includes it once published, or vendoring the patched file-copy logic. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours: Identify all internal and third-party mobile applications using react-native-receive-sharing-intent and assess installed user base. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

Same weakness CWE-22 – Path Traversal

View all
CVE-2019-3396 CRITICAL POC
9.8
CVE-2019-19781 CRITICAL POC
9.8
CVE-2020-5902 CRITICAL POC
9.8
CVE-2021-40444 HIGH POC
8.8
CVE-2021-27065 HIGH POC
7.8
CVE-2019-11510 CRITICAL POC
10.0
CVE-2018-13379 CRITICAL POC
9.1
CVE-2015-0016 HIGH POC
7.8

Same technique Path Traversal

View all
CVE-2025-64446 CRITICAL POC
9.8
CVE-2015-0016 HIGH POC
7.8
CVE-2016-0752 HIGH POC
7.5
CVE-2024-13159 CRITICAL POC
9.8
CVE-2024-13160 CRITICAL POC
9.8
CVE-2024-13161 CRITICAL POC
9.8
CVE-2014-0780 CRITICAL POC
9.8
CVE-2024-48248 HIGH POC
8.6

Share

CVE-2026-58460 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy