Description

A security flaw has been discovered in achorein expo-share-intent up to 8.0.0. This affects the function getDataColumn of the file ExpoShareIntentModule.kt of the component Android File Copy Routine. The manipulation of the argument _display_name results in path traversal. The attack requires a local approach. Upgrading to version 8.0.1 is able to mitigate this issue. The patch is identified as c6900b1ed06fcc3ca4b09651348974ac5b95e4e6. The affected component should be upgraded.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.4",
  "pubDate": "2026-08-24T05:16:55.713Z",
  "pubdate": "2026-08-24T05:16:55.713Z",
  "executiveSummary": "A path traversal vulnerability exists in the achorein expo-share-intent library up to version 8.0.0, specifically within the Android File Copy Routine.\nThe vulnerability resides in the getDataColumn function of the ExpoShareIntentModule.kt file, where improper handling of the _display_name argument allows an attacker to manipulate file paths.\nSuccessful exploitation of this flaw can lead to unauthorized file system access or manipulation on the affected mobile device.\nThe product is vulnerable when processing shared content on Android platforms.\nThe risk implications include potential exposure of sensitive application data or arbitrary file operations.\nThe attack requires a local approach, meaning the threat actor must interact locally or leverage another vector to supply maliciously crafted file metadata to the vulnerable component.",
  "technicalDetails": "The vulnerability is classified as a path traversal flaw affecting the Android File Copy Routine component of the achorein expo-share-intent package across versions up to 8.0.0.\nThe root cause of the issue stems from insufficient input validation and sanitization of the _display_name argument within the getDataColumn function located in the ExpoShareIntentModule.kt source file.\nWhen the application queries content providers or processes shared intents, it retrieves metadata such as the display name to handle file copying operations.\nIf an attacker supplies a crafted _display_name containing directory traversal sequences (such as relative path characters like '../'), the routine fails to adequately neutralize these sequences before resolving the destination or source file paths.\nConsequently, the file copy operation can read from or write to arbitrary locations outside the intended application-specific storage directory, depending on file permissions and the execution context.\nExploitation is strictly local, requiring the attacker to execute or interface with the vulnerable application logic locally, such as through a malicious application or intent injection that interacts with the vulnerable share intent receiver.\nAuthentication and elevated privileges are not explicitly required beyond local execution capabilities on the Android device.\nThe attack flow proceeds as follows: 1) The attacker initiates a share intent or manipulates content provider responses containing a maliciously crafted _display_name parameter; 2) The ExpoShareIntentModule.kt component invokes getDataColumn to process the incoming file details; 3) The application constructs the file path utilizing the unsanitized _display_name; 4) The file copy routine resolves the traversal sequences, granting unauthorized access to the targeted directory structure.\nPost-exploitation impact includes the potential unauthorized disclosure, overwrite, or corruption of files accessible to the application's file storage context."
}