CVE-2026-78196

A security flaw has been discovered in achorein expo-share-intent up to 8.0.0. This affects the function getDataColumn of the file ExpoShareIntentModule.kt of the component Android File Copy Routine. The manipulation of the argument _display_name results in path traversal. The attack requires a local approach. Upgrading to version 8.0.1 is able to mitigate this issue. The patch is identified as c6900b1ed06fcc3ca4b09651348974ac5b95e4e6. The affected component should be upgraded.

CVSS v3 4.4 MEDIUM
CVSS v2.0 3.2 LOW

4.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.8 / Impact : 2.5

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

3.2^/10

CVSS v2.0 : LOW

Vector : AV:L/AC:L/Au:S/C:N/I:P/A:P

Exploitability : 3.1 / Impact : 4.9

Access Vector LOCAL

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://github.com/achorein/expo-share-intent/
https://github.com/achorein/expo-share-intent/commit/c6900b1ed06fcc3ca4b09651348974ac5b95e4e6
https://github.com/achorein/expo-share-intent/pull/221
https://github.com/achorein/expo-share-intent/releases/tag/v8.0.1
https://vuldb.com/cve/CVE-2026-78196
https://vuldb.com/submit/885425
https://vuldb.com/vuln/394573
https://vuldb.com/vuln/394573/cti

Configurations

No configuration.

History

12 Oct 2026, 16:10

Type	Values Removed	Values Added
Summary		(es) Una falla de seguridad ha sido descubierta en achorein expo-share-intent hasta la versión 8.0.0. Esto afecta la función getDataColumn del archivo ExpoShareIntentModule.kt del componente Android File Copy Routine. La manipulación del argumento _display_name resulta en salto de ruta. El ataque requiere un enfoque local. La actualización a la versión 8.0.1 puede mitigar este problema. El parche se identifica como c6900b1ed06fcc3ca4b09651348974ac5b95e4e6. El componente afectado debe ser actualizado.

Information

Published : 2026-08-24 05:16

Updated : 2026-10-12 16:10

NVD link : CVE-2026-78196

Mitre link : CVE-2026-78196

CVE.ORG link : CVE-2026-78196

JSON object : View

Products Affected

No product.

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

{"id": "CVE-2026-78196", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-78196", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-26T18:18:47.417031Z"}}], "cvssMetricV2": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"version": "2.0", "baseScore": 3.2, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:S/C:N/I:P/A:P", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 4.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 3.1, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.4, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 2.5, "exploitabilityScore": 1.8}], "cvssMetricV40": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 4.8, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "cna@vuldb.com", "affectedData": [{"cpes": ["cpe:2.3:a:achorein:expo-share-intent:*:*:*:*:*:*:*:*"], "vendor": "achorein", "modules": ["Android File Copy Routine"], "product": "expo-share-intent", "versions": [{"status": "affected", "version": "8.0"}, {"status": "unaffected", "version": "8.0.1"}]}]}], "published": "2026-08-24T05:16:55.713", "references": [{"url": "https://github.com/achorein/expo-share-intent/", "source": "cna@vuldb.com"}, {"url": "https://github.com/achorein/expo-share-intent/commit/c6900b1ed06fcc3ca4b09651348974ac5b95e4e6", "source": "cna@vuldb.com"}, {"url": "https://github.com/achorein/expo-share-intent/pull/221", "source": "cna@vuldb.com"}, {"url": "https://github.com/achorein/expo-share-intent/releases/tag/v8.0.1", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/cve/CVE-2026-78196", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/submit/885425", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/vuln/394573", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/vuln/394573/cti", "source": "cna@vuldb.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "cna@vuldb.com", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "A security flaw has been discovered in achorein expo-share-intent up to 8.0.0. This affects the function getDataColumn of the file ExpoShareIntentModule.kt of the component Android File Copy Routine. The manipulation of the argument _display_name results in path traversal. The attack requires a local approach. Upgrading to version 8.0.1 is able to mitigate this issue. The patch is identified as c6900b1ed06fcc3ca4b09651348974ac5b95e4e6. The affected component should be upgraded."}, {"lang": "es", "value": "Una falla de seguridad ha sido descubierta en achorein expo-share-intent hasta la versi\u00f3n 8.0.0. Esto afecta la funci\u00f3n getDataColumn del archivo ExpoShareIntentModule.kt del componente Android File Copy Routine. La manipulaci\u00f3n del argumento _display_name resulta en salto de ruta. El ataque requiere un enfoque local. La actualizaci\u00f3n a la versi\u00f3n 8.0.1 puede mitigar este problema. El parche se identifica como c6900b1ed06fcc3ca4b09651348974ac5b95e4e6. El componente afectado debe ser actualizado."}], "lastModified": "2026-10-12T16:10:00.220", "sourceIdentifier": "cna@vuldb.com"}