Dashboard / CVE-2026-60117

CVE-2026-60117

MEDIUM
MEDIUM Priority: 0.01 BB Relevance: 49/100
Published: 2026-11-09 Modified: 2026-11-12 First seen: 2026-11-09 Status: active

Attack Surface

Low Complexity No Auth No Interaction Integ. Impact

CVSS Vector Breakdown

AV: Local
AC: Low
PR: None
UI: None
S: X
AT: None
VC: None
VI: High
VA: None

Description

The Android implementation of the Flutter/Dart receive_sharing_intent package, versions 1.4.1 through 1.9.0, contains a path traversal vulnerability in FileDirectory.getDataColumn that allows a malicious co-resident application to write files outside the intended cache directory by supplying a crafted _display_name value from an untrusted ContentProvider. Attackers can use a path-shaped display name ../databases/proof.txt combined with a controlled content stream to write to arbitrary locations within the receiving application's private sandbox under its UID, achieving file overwrite without user interaction.

Weakness Classification (1)

Affected Software (1)

VendorProductVersion
KasemJaffer receive_sharing_intent 1.4.1

References & Advisories (3)

Bug Bounty Relevance

49 / 100
✓ No authentication
✓ Low complexity
✓ No user interaction

CVSS Score

6.9 / 10.0 v4.0
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS — Exploitation Probability

0.15%
Raw Score 0.001460
Percentile 3.9%
Date 2026-11-13

EPSS Trend

2026-11-13
0.00146
2026-11-12
0.00146
2026-11-10
0.00146

Intelligence Sources

mitre ref →
nvd ref →

External Links