Description

FairEmail is a fully featured, open source, privacy-friendly email app for Android. Prior to 1.2325, shared attachment handling does not adequately sanitize an attacker-controlled filename before constructing its destination path. A local attacker-controlled app can therefore supply path components that escape the intended shared attachment directory and overwrite or corrupt files in the FairEmail private data directory, including account or message databases. Exploitation requires app lock using PIN or biometric authentication and user interaction to unlock FairEmail. This issue is fixed in version 1.2325.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-11-05T23:16:56.587Z",
  "pubdate": "2026-11-05T23:16:56.587Z",
  "executiveSummary": "FairEmail, prior to version 1.2325, is susceptible to a path traversal vulnerability resulting from inadequate input sanitization of shared attachment filenames. This flaw allows a malicious local application to manipulate file paths, potentially leading to the corruption or unauthorized overwrite of files within the application's private data directory. The vulnerability poses a significant risk to the integrity of sensitive data, including account configurations and message databases. Successful exploitation requires the presence of an active app lock (PIN or biometric authentication) and necessitates user interaction to unlock the application. The attack is strictly local and necessitates that the attacker possesses the capability to deliver a malicious intent or interaction to the target application on the device. Version 1.2325 addresses this issue by implementing robust path validation, effectively neutralizing the path traversal vector.",
  "technicalDetails": "The vulnerability originates in the logic governing the processing of shared attachments within FairEmail. When an external application provides a file to FairEmail via an intent or share mechanism, the application fails to perform sufficient path normalization or validation on the provided filename string. This failure allows an attacker-controlled application to inject path traversal sequences—specifically dot-dot-slash (../) sequences—into the filename variable.\nBy crafting a malicious filename containing these directory traversal components, an attacker can escape the designated temporary or shared attachment directory. The application, while constructing the destination file path, blindly joins the unsanitized input to its base path, causing the file operation to resolve to unintended locations within the application's private sandbox directory (e.g., /data/data/eu.faircode.email/files/ or equivalent).\nThe attack flow begins with the malicious application invoking a share intent directed at FairEmail with a crafted filename attribute. Because FairEmail requires an app lock (PIN or biometric authentication) to function, the exploit relies on the victim user unlocking the application. Once unlocked, the application's underlying handling routine processes the path, effectively traversing out of the expected directory and performing a write operation to a critical resource. Depending on the target path, this can result in the corruption of SQLite databases containing account credentials, synchronization tokens, or cached email messages.\nThis vulnerability is classified as an improper sanitization of special elements used in a path, a classic path traversal pattern. It highlights the security risk of trusting input from external Android components when performing file I/O operations within the private internal storage of an application. The exploit is limited to the local device environment and does not involve remote network-based transmission of the payload; however, the impact is severe due to the potential loss of data integrity and the compromise of the application's internal database structures. Version 1.2325 of FairEmail remediates this by strictly sanitizing file naming and verifying that the final destination path remains confined to the intended, secure directory, rejecting any input that attempts to escape that scope."
}