Harvest: Possible to steal any protected files on Android

Hi. I have found an issue which allows to retrieve any files from /data/data/com.harvestapp/ directory. The problem is in exported activity com.harvestapp.app.EditExpenseActivity which accepts URI to a pdf to be processed and saved it on SD Card which is world accessible directory, but in real...