Description

A vulnerability was identified in MapQuest Get Directions App 10.16.1 on Android. This vulnerability affects the function getDataColumn of the file ExpoShareIntentModule.kt of the component com.mapquest.android.ace. The manipulation leads to path traversal. An attack has to be approached locally. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.4",
  "pubDate": "2026-09-02T03:16:48.173Z",
  "pubdate": "2026-09-02T03:16:48.173Z",
  "executiveSummary": "A path traversal vulnerability has been identified in the MapQuest Get Directions App (version 10.16.1) for Android.\nThe vulnerability resides within the getDataColumn function of the ExpoShareIntentModule.kt file, part of the com.mapquest.android.ace component.\nThis flaw allows a local attacker to perform unauthorized file system access by manipulating file paths handled by the application.\nThe vulnerability necessitates local physical or logical access to the device to execute the exploit.\nAs the vendor has remained unresponsive to disclosure attempts and public exploits are available, the risk to users is elevated.\nSuccessful exploitation could lead to unauthorized disclosure of sensitive data stored within the application's private directory or other accessible areas on the file system.",
  "technicalDetails": "The vulnerability stems from improper input validation within the getDataColumn function located in the ExpoShareIntentModule.kt file. This function is responsible for resolving content provider URIs or file paths received via intent data.\nThe root cause is the failure to sanitize user-supplied path strings, which allows an attacker to inject directory traversal sequences (such as '../').\nIn the context of the Android environment, when the application processes a malicious intent, it may pass these unsanitized paths to file system APIs. By utilizing traversal sequences, the application is misled into accessing or exposing files outside of the intended directory sandbox.\nThe attack flow begins with an attacker crafting a malicious Intent that triggers the ExpoShareIntentModule. An attacker with local access to the device—either through a secondary malicious application or by leveraging other local side-channel vectors—can broadcast this intent to the MapQuest application.\nOnce the intent is received, the getDataColumn function processes the provided URI or path string. Because the function does not implement adequate validation or path normalization (e.g., verifying that the resulting path is strictly within the expected application-specific storage directory), it inadvertently resolves the path to arbitrary files on the system.\nThe exploitation does not require prior network exposure; it is restricted to local attack vectors. Because the application interacts with the file system on behalf of the user, the effective privilege level is determined by the app's own file system permissions.\nPost-exploitation impact involves the potential reading of sensitive application data, including configuration files, local databases, or cached user information. In some Android configurations, this may facilitate the exfiltration of information that the application has been granted permission to access, bypassing intended security boundaries within the application's implementation.\nThe absence of vendor response implies that the vulnerability remains unpatched in the specified version, leaving the application logic in com.mapquest.android.ace inherently insecure when processing untrusted inputs via the affected module."
}