CVE-2026-84442: MapQuest Get Directions App com.mapquest.android.ace ExpoShareIntentModule.kt getDataColumn path traversal
A vulnerability was identified in MapQuest Get Directions App 10.16.1 on Android. This vulnerability affects the function getDataColumn of the file ExpoShareIntentModule.kt of the component com.mapquest.android.ace. The manipulation leads to path traversal. An attack has to be approached locally. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users of MapQuest Get Directions App version 10.16.1 on Android are the identified affected population. Exploitation must be approached locally, so a remote-only attacker is not indicated by the available data.
What level of access does an attacker need?
The severity vector indicates local attack access, low attack complexity, low privileges required, and no user interaction. The reported impact is limited to integrity and availability; no confidentiality impact is listed.
Is exploit code available?
Yes. The vulnerability information states that a public exploit is available and might be used.
Is a vendor fix or response available?
No vendor response is reported. The vendor was contacted early about the disclosure but did not respond, and the provided information does not identify a fixed version or workaround.