CVE-2026-58128: Alan: Health Insurance for Android 1.450.0 Path Traversal via ShareReceiverActivity
Alan: Health Insurance for Android (com.alanmobile) 1.450.0 contains a path traversal vulnerability that allows a co-resident malicious application to write attacker-controlled files outside the intended directory via the exported ShareReceiverActivity, which uses an unsanitized displayname value from a shared content URI to construct the destination file path. Attackers can send a crafted ACTIONSEND intent with a displayname containing directory traversal sequences to overwrite sensitive files within the app's sandbox such as databases, sharedprefs, and WebView data, enabling state tampering or code execution in the app's context without authentication or user interaction.
Event History
Frequently Asked Questions
Who can exploit this issue?
A malicious application installed on the same Android device can exploit the exported ShareReceiverActivity. It does not require authentication or user interaction, but it requires local app execution on the device.
What does an attacker need to send to trigger the vulnerability?
The attacker needs to send a crafted ACTION_SEND intent to ShareReceiverActivity with a shared content URI whose _display_name contains directory traversal sequences. The vulnerable activity uses that value to construct the destination file path without sanitization.
What could be modified if exploitation succeeds?
An attacker can write attacker-controlled files outside the intended directory and overwrite files in the application's sandbox. Examples identified include databases, shared preferences, and WebView data, which can enable application state tampering or code execution in the app's context.