CVE-2026-60117

Description

The Android implementation of the Flutter/Dart receive_sharing_intent package, versions 1.4.1 through 1.9.0, contains a path traversal vulnerability in FileDirectory.getDataColumn that allows a malicious co-resident application to write files outside the intended cache directory by supplying a crafted _display_name value from an untrusted ContentProvider. Attackers can use a path-shaped display name ../databases/proof.txt combined with a controlled content stream to write to arbitrary locations within the receiving application's private sandbox under its UID, achieving file overwrite without user interaction.

References

https://www.vulncheck.com/advisories/receive-sharing-intent-path-traversal-via-filedirectory

https://github.com/actuator/receive_sharing_intent/blob/security/contain-shared-file-cache-writes/docs/security/CWE-22-display-name-path-traversal.md

https://github.com/KasemJaffer/receive_sharing_intent/pull/418

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-120158

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3

CVSS v4