Executive brief
Blix Blue Mail Calendar App for Android contains a path traversal vulnerability in its file-sharing handler that allows any installed app to write arbitrary files into Blue Mail's private storage without requiring permissions. An attacker can manipulate shared file names to escape the intended cache directory and overwrite configuration, database files, or app state, potentially compromising email accounts and user data.
Technical details
The vulnerability is a path traversal (CWE-22) in the bundled react-native-receive-sharing-intent library's FileDirectory.getDataColumn() and FileDirectory.getFileFromUri() functions. When Blue Mail receives a shared file via an exported ACTION_SEND intent, the destination filename is read from the attacker-controlled _display_name ContentProvider column and directly concatenated to getCacheDir() without sanitization. An attacker can inject "../" sequences to traverse out of the cache directory into the app's private data root (/data/user/0/me.bluemail.mail/), allowing writes to shared_prefs, MMKV stores, and databases. The attack requires only local access and user interaction to share a file; the attacker app needs zero permissions. Exploitation is possible before any draft save or network operation, making it viable for state and config tampering.
Affected products
- Blix Blue Mail Calendar App 2.2.305
Timeline
- 2026-08-03: disclosed
- other: Exploit code published; vendor did not respond to early disclosure