CVE-2026-68509: FairEmail: Path traversal in shared attachment handling can write files outside the intended shared directory
FairEmail is a fully featured, open source, privacy-friendly email app for Android. Prior to 1.2325, shared attachment handling does not adequately sanitize an attacker-controlled filename before constructing its destination path. A local attacker-controlled app can therefore supply path components that escape the intended shared attachment directory and overwrite or corrupt files in the FairEmail private data directory, including account or message databases. Exploitation requires app lock using PIN or biometric authentication and user interaction to unlock FairEmail. This issue is fixed in version 1.2325.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FairEmailto a version that resolves this vulnerability.Fixed in 1.2325
Event History
Frequently Asked Questions
Which devices are exposed to this issue?
FairEmail installations prior to version 1.2325 are affected when app lock is configured with PIN or biometric authentication. The attacker must have a local attacker-controlled app on the same Android device.
What does an attacker need to exploit the flaw?
The attacker needs to provide a crafted shared attachment filename containing path components and convince the user to unlock FairEmail. No attacker privileges are required, but exploitation has high complexity and requires user interaction.
What can be impacted if exploitation succeeds?
A crafted filename can escape the shared attachment directory and overwrite or corrupt files in FairEmail's private data directory. This can include account or message databases, affecting integrity and availability.
What should users do if they cannot update immediately?
The provided information identifies version 1.2325 as the fix but does not specify a workaround. Until updating, avoid unlocking FairEmail in response to attachment-sharing activity initiated by untrusted local apps.
How can I determine whether I am affected?
Check the installed FairEmail version and update if it is earlier than 1.2325. Also determine whether FairEmail app lock is enabled with a PIN or biometric authentication, as this is required for exploitation.