CVE-2026-78196 in expo-share-intent
Summary
by MITRE • 08/24/2026
A security flaw has been discovered in achorein expo-share-intent up to 8.0.0. This affects the function getDataColumn of the file ExpoShareIntentModule.kt of the component Android File Copy Routine. The manipulation of the argument _display_name results in path traversal. The attack requires a local approach. Upgrading to version 8.0.1 is able to mitigate this issue. The patch is identified as c6900b1ed06fcc3ca4b09651348974ac5b95e4e6. The affected component should be upgraded.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/24/2026
A critical path traversal vulnerability has been identified within the achorein expo-share-intent library, specifically affecting versions up to and including 8.0.0. This flaw resides in the getDataColumn function located in the ExpoShareIntentModule.kt file, which is part of the Android File Copy Routine component. The vulnerability arises from improper validation of user-supplied input, particularly regarding the _display_name argument passed during intent handling operations on the Android platform. When an application utilizes this library to process shared content or files via system intents, it fails to adequately sanitize filenames before using them in file system operations. This lack of rigorous input sanitization allows for the injection of directory traversal sequences such as dot-dot-slash characters into the filename parameter.
The technical nature of this flaw aligns with CWE-22, which defines Improper Limitation of a Pathname to a Restricted Directory, commonly known as path traversal or directory traversal. By manipulating the _display_name argument, an attacker can construct file paths that escape the intended target directory and access arbitrary files on the device's local storage. This capability is particularly dangerous in mobile environments where sensitive data such as personal documents, credentials stored in configuration files, or other application-specific resources may reside outside of the app's sandboxed directories if proper isolation mechanisms are not enforced by the host application. The vulnerability exploits the way Android handles file URIs and intent extras, allowing maliciously crafted intents to trick the library into writing or reading from unintended locations on the filesystem.
The operational impact of this vulnerability is significant for applications integrating expo-share-intent versions prior to 8.0.1. Since the attack vector requires a local approach, it typically involves an attacker having some level of access to the device, such as through another malicious application that can send broadcast intents or share files with the vulnerable app. In scenarios where multiple apps are installed on a single device, this could lead to unauthorized data disclosure if the host application has permissions to read sensitive areas of the filesystem. Furthermore, depending on how the retrieved file content is subsequently processed by the host application, there may be secondary risks involving code execution or further system compromise, although the primary risk remains information leakage through path traversal. This scenario maps closely to ATT&CK techniques related to Local File Access and potentially Data from Information Repositories if sensitive files are exfiltrated after being accessed via the vulnerability.
Mitigation for this issue is straightforward and well-documented by the library maintainers. The recommended course of action is to upgrade the achorein expo-share-intent dependency to version 8.0.1 or later, where the path traversal flaw has been addressed through improved input validation logic in the getDataColumn function. Developers should verify their build configurations to ensure that no older versions are being pulled transitively by other dependencies. Additionally, while upgrading is the primary fix, application developers should also implement defense-in-depth strategies such as validating file paths against a whitelist of allowed directories and ensuring that any files accessed via intent extras are strictly confined within the app's private storage area whenever possible. This reduces the blast radius in case future vulnerabilities arise or if other components introduce similar weaknesses. The specific patch resolving this issue is identified by commit hash c6900b1ed06fcc3ca4b09651348974ac5b95e4e6, which developers can review to understand the exact code changes implemented to enforce proper path normalization and restriction.