CVE-2026-78196: achorein expo-share-intent Android File Copy Routine ExpoShareIntentModule.kt getDataColumn path traversal
A security flaw has been discovered in achorein expo-share-intent up to 8.0.0. This affects the function getDataColumn of the file ExpoShareIntentModule.kt of the component Android File Copy Routine. The manipulation of the argument displayname results in path traversal. The attack requires a local approach. Upgrading to version 8.0.1 is able to mitigate this issue. The patch is identified as c6900b1ed06fcc3ca4b09651348974ac5b95e4e6. The affected component should be upgraded.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
achorein expo-share-intent Android File Copy Routine (ExpoShareIntentModule.kt)to a version that resolves this vulnerability.Fixed in 8.0.1Patch c6900b1ed06fcc3ca4b09651348974ac5b95e4e6
Event History
Frequently Asked Questions
Which versions should be treated as affected?
achorein expo-share-intent versions up to and including 8.0.0 are affected. Version 8.0.1 mitigates the issue.
What access does an attacker need to exploit this issue?
Exploitation requires local access and low privileges. No user interaction is required according to the provided severity vector.
What is the recommended remediation?
Upgrade the affected achorein expo-share-intent component to version 8.0.1. The identified patch is c6900b1ed06fcc3ca4b09651348974ac5b95e4e6.