CVE-2026-58128 in Insurance
Summary
by MITRE • 11/04/2026
Alan: Health Insurance for Android (com.alanmobile) 1.450.0 contains a path traversal vulnerability that allows a co-resident malicious application to write attacker-controlled files outside the intended directory via the exported ShareReceiverActivity, which uses an unsanitized _display_name value from a shared content URI to construct the destination file path. Attackers can send a crafted ACTION_SEND intent with a _display_name containing directory traversal sequences to overwrite sensitive files within the app's sandbox such as databases, shared_prefs, and WebView data, enabling state tampering or code execution in the app's context without authentication or user interaction.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 11/04/2026
The vulnerability identified in Alan Health Insurance for Android version 1.450.0 represents a critical security flaw rooted in improper input validation within the application's intent handling mechanisms. Specifically, the exported ShareReceiverActivity component fails to adequately sanitize file names received through shared content URIs. When an external application sends an ACTION_SEND intent containing media or text data, it can include metadata such as _display_name which specifies the filename for the saved asset. In this instance, the application directly incorporates this unsanitized string into a path construction operation without verifying that the value remains within the expected directory boundaries. This lack of validation allows a co-resident malicious application to inject directory traversal sequences, commonly known as dot-dot-slash or ..\ characters, into the filename parameter. By doing so, the attacker can manipulate the file system navigation logic to escape the designated upload or cache directory and write files to arbitrary locations within the app's private sandbox storage area.
From a technical perspective, this flaw is classified under CWE-22: Improper Limitation of a Pathname to a Restricted Directory. The core issue lies in the application's failure to normalize or validate the input path before using it for file system operations. Android applications typically operate within isolated sandboxes where private data such as SQLite databases, shared preferences containing user session tokens or configuration settings, and WebView local storage are stored securely. However, when an exported activity accepts external intents without rigorous checks on resource identifiers or metadata values like filenames, it creates a bridge that malicious apps can exploit. The attacker crafts a specific intent payload with the _display_name field set to include traversal sequences followed by the target filename. Upon processing this intent, the application's internal logic resolves the path incorrectly, allowing writes outside the intended subdirectory and effectively bypassing Android's default file permission restrictions for private app data.
The operational impact of this vulnerability is severe due to its potential for state tampering and unauthorized code execution within the context of the vulnerable application. Since the attacker can overwrite sensitive files such as databases or shared preferences, they can alter critical application states without requiring user interaction or authentication. For example, by modifying database records, an attacker could manipulate account balances, change health data integrity, or escalate privileges within the app's internal logic. Furthermore, if the application allows loading of local resources from these directories for display purposes, overwriting HTML or JavaScript files in WebView storage could lead to cross-site scripting-like effects where malicious scripts execute with the full permissions and context of the Alan Health Insurance app. This effectively compromises the confidentiality, integrity, and availability of user data processed by the health insurance platform.
This attack vector aligns closely with ATT&CK techniques related to Application Access Control Bypass and Data Injection via External Input. The exploitation requires a co-resident malicious application, meaning the attacker must have previously installed an app on the same device that possesses the necessary permissions to send intents or read shared content URIs. While this limits the attack surface compared to remote exploits, it remains highly dangerous in environments where users install applications from untrusted sources or when malware is pre-installed by compromised OEMs. The lack of user interaction required for exploitation makes this particularly insidious, as victims may remain unaware that their sensitive health and financial data has been tampered with until anomalies appear within the application's behavior.
Mitigation strategies must focus on strict input validation and secure file handling practices. Developers should implement a robust allowlist approach for filenames received via intents, ensuring that only alphanumeric characters and safe punctuation are permitted while explicitly rejecting any path traversal sequences such as .. or /. Additionally, using Java NIO Path objects with the normalize() method can help resolve relative paths before performing file operations, although this alone is insufficient without explicit validation. The application should also verify that the resolved canonical path starts with the expected base directory to ensure no escape occurs even if normalization fails due to edge cases. Furthermore, reducing the attack surface by removing unnecessary exported activities or restricting them via android:exported=false unless absolutely required for inter-app communication can significantly reduce risk. Regular security audits and static analysis tools configured to detect CWE-22 patterns are essential to prevent such vulnerabilities in future releases of health-related Android applications handling sensitive user data.