CVE-2026-60117: receive_sharing_intent 1.4.1-1.9.0 Path Traversal via FileDirectory

Q: Which applications are exposed to this issue?

Android applications that use receive_sharing_intent versions 1.4.1 through 1.9.0 are affected. Exploitation requires a malicious application to be co-resident on the same Android device and able to provide untrusted content to the receiving application.

Q: What does an attacker need to exploit the vulnerability?

The attacker needs to supply content through an untrusted ContentProvider with a crafted _display_name, such as ../databases/proof.txt, and a controlled content stream. No user interaction or privileges are required according to the provided vector.

Q: What is the practical impact of a successful exploit?

A malicious co-resident application can cause files to be written outside the intended cache directory. The write is limited to locations within the receiving application's private sandbox under that application's UID, but may overwrite application files such as database files.

Q: How can I determine whether my application is affected?

Check whether the Android build of your application includes receive_sharing_intent at a version from 1.4.1 through 1.9.0. Applications using FileDirectory.getDataColumn to handle shared content from untrusted ContentProviders are exposed to the described path traversal condition.

Published Nov 9, 2026

Updated

The Android implementation of the Flutter/Dart receivesharingintent package, versions 1.4.1 through 1.9.0, contains a path traversal vulnerability in FileDirectory.getDataColumn that allows a malicious co-resident application to write files outside the intended cache directory by supplying a crafted displayname value from an untrusted ContentProvider. Attackers can use a path-shaped display name ../databases/proof.txt combined with a controlled content stream to write to arbitrary locations within the receiving application's private sandbox under its UID, achieving file overwrite without user interaction.

Affected Software

1 affected component

pub/receive_sharing_intent>=1.4.1<=1.9.0

Event History

Nov 9, 2026

CVE Published

via MITRE·05:49 PM

Data Sourced

via MITRE·05:49 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·06:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which applications are exposed to this issue?

Android applications that use receive_sharing_intent versions 1.4.1 through 1.9.0 are affected. Exploitation requires a malicious application to be co-resident on the same Android device and able to provide untrusted content to the receiving application.

What does an attacker need to exploit the vulnerability?

The attacker needs to supply content through an untrusted ContentProvider with a crafted _display_name, such as ../databases/proof.txt, and a controlled content stream. No user interaction or privileges are required according to the provided vector.

What is the practical impact of a successful exploit?

A malicious co-resident application can cause files to be written outside the intended cache directory. The write is limited to locations within the receiving application's private sandbox under that application's UID, but may overwrite application files such as database files.

How can I determine whether my application is affected?

Check whether the Android build of your application includes receive_sharing_intent at a version from 1.4.1 through 1.9.0. Applications using FileDirectory.getDataColumn to handle shared content from untrusted ContentProviders are exposed to the described path traversal condition.

CVE-2026-60117: receive_sharing_intent 1.4.1-1.9.0 Path Traversal via FileDirectory

Affected Software

Event History

Frequently Asked Questions

Which applications are exposed to this issue?

What does an attacker need to exploit the vulnerability?

What is the practical impact of a successful exploit?

How can I determine whether my application is affected?

Company

Resources

Contact

Frequently Asked Questions

Which applications are exposed to this issue?

What does an attacker need to exploit the vulnerability?

What is the practical impact of a successful exploit?

How can I determine whether my application is affected?