Expo Share Intent
Monthly
Path traversal in achorein expo-share-intent up to version 8.0.0 allows a local attacker to write files outside the intended cache directory by supplying a crafted `_display_name` value during Android file sharing operations. The `getDataColumn` function in `ExpoShareIntentModule.kt` constructed file paths directly from the unvalidated content-provider display name, enabling directory escape via sequences such as `../../`. No public exploit code has been identified and this vulnerability is not listed in CISA KEV; a vendor-released patch (v8.0.1) resolves the issue.
Path traversal in achorein expo-share-intent up to version 8.0.0 allows a local attacker to write files outside the intended cache directory by supplying a crafted `_display_name` value during Android file sharing operations. The `getDataColumn` function in `ExpoShareIntentModule.kt` constructed file paths directly from the unvalidated content-provider display name, enabling directory escape via sequences such as `../../`. No public exploit code has been identified and this vulnerability is not listed in CISA KEV; a vendor-released patch (v8.0.1) resolves the issue.