CVE-2026-18648: Blix Email Blue Mail Calendar App react-native-receive-sharing-intent FileDirectory.getFileFromUri path traversal
A vulnerability was detected in Blix Email Blue Mail Calendar App 2.2.305. Impacted is the function FileDirectory.getDataColumn/FileDirectory.getFileFromUri of the component react-native-receive-sharing-intent. The manipulation of the argument displayname results in path traversal. The attack is only possible with local access. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2026-18648?
CVE-2026-18648 is a path traversal vulnerability found in the Blix Email Blue Mail Calendar App's handling of file URIs.
What is the severity of CVE-2026-18648?
The severity of CVE-2026-18648 is medium with a CVSS score of 5.3.
How do I fix CVE-2026-18648?
To fix CVE-2026-18648, update the Blix Email Blue Mail Calendar App to the latest version where the vulnerability has been patched.
Who is affected by CVE-2026-18648?
Users of the Blix Email Blue Mail Calendar App version 2.2.305 are affected by CVE-2026-18648.
What are the consequences of exploiting CVE-2026-18648?
Exploiting CVE-2026-18648 may allow attackers to access unintended file paths, leading to potential data exposure.