CVE-2026-60117

The Android implementation of the Flutter/Dart receive_sharing_intent package (versions 1.4.1 through 1.9.0 ) is vulnerable to a path traversal vulnerability in FileDirectory.getDataColumn. A malicious co-resident application can exploit this by providing a crafted _display_name value via an untr...

EUVD-2026-120158

The Android implementation of the Flutter/Dart receivesharingintent package, versions 1.4.1 through 1.9.0, contains a path traversal vulnerability in FileDirectory.getDataColumn that allows a malicious co-resident application to write files outside the intended cache directory by supplying a...

PT-2026-140939

The Android implementation of the Flutter/Dart receive sharing intent package, versions 1.4.1 through 1.9.0, contains a path traversal vulnerability in FileDirectory.getDataColumn that allows a malicious co-resident application to write files outside the intended cache directory by supplying a...

CVE-2026-18648: Improper Limitation of a Pathname to a Restricted Directory

A vulnerability was detected in Blix Email Blue Mail Calendar App 2.2.305. Impacted is the function FileDirectory.getDataColumn/FileDirectory.getFileFromUri of the component react-native-receive-sharing-intent. The manipulation of the argument displayname results in path traversal. The attack is...