CVE-2026-107056: Security vulnerability

Published Oct 29, 2026

Updated

Insecure permissions in the io.file.importer.ImportActivity component of OpenTracks versionCode 6751 allows unauthorized attackers to inject crafted tracking data into the victim's location database via a crafted SEND message.

Event History

Oct 29, 2026

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Data Sourced

via NVD·05:17 PM

Description

Frequently Asked Questions

What does an attacker need to exploit this issue?

An attacker needs to send a crafted SEND message to the io.file.importer.ImportActivity component. The issue allows crafted tracking data to be injected into the victim's location database.

Who is exposed to this vulnerability?

Users of OpenTracks with versionCode 6751 are affected. The vulnerable component is the file importer activity.

How can I tell whether an exploitation attempt may have succeeded?

Review the application's location database for unexpected or untrusted tracking data. The reported impact is injection of crafted tracking data through a SEND message.

CVE-2026-107056: Security vulnerability

Event History

Frequently Asked Questions

What does an attacker need to exploit this issue?

Who is exposed to this vulnerability?

How can I tell whether an exploitation attempt may have succeeded?

Company

Resources

Contact

Frequently Asked Questions

What does an attacker need to exploit this issue?

Who is exposed to this vulnerability?

How can I tell whether an exploitation attempt may have succeeded?