Executive brief
A vulnerability in the react-native-receive-sharing-intent library, which helps mobile apps handle shared files and links, allows a malicious app installed on the same device to overwrite the victim app's private data. By sending a specially crafted file share request, an attacker can bypass security boundaries to corrupt databases, change app settings, or potentially gain further control over the affected application. This occurs without requiring any special permissions or user interaction beyond the malicious app being present on the device.
Technical details
A path traversal vulnerability exists in the `FileDirectory.getDataColumn` method of the `react-native-receive-sharing-intent` library. The library fails to sanitize the `_display_name` column retrieved from an incoming `content://` URI, using it directly to construct a destination file path within the application's cache directory. A malicious co-resident application can act as a ContentProvider and send an explicit `ACTION_SEND` intent containing 'dot-dot' (`../`) sequences in the display name. This allows the attacker to write arbitrary content to any location within the consuming app's private data directory, potentially leading to the overwriting of databases, shared preferences, or executable scripts. A patch has been proposed in pull request #192 to sanitize filenames and enforce canonical path containment.
Affected products
- ajith-ab react-native-receive-sharing-intent <= commit b375726 (including version 2.0.0)
Timeline
- 2026-07-02: disclosed
- 2026-07-02: advisory