Executive brief
expo-share-intent is an Expo Native Module that handles file sharing on Android. A path traversal vulnerability in the file copy routine allows local attackers to escape the intended cache directory and write files to arbitrary locations on the device, potentially compromising system integrity or overwriting sensitive application data.
Technical details
A path traversal vulnerability (CWE-22) exists in the getDataColumn function of ExpoShareIntentModule.kt in the Android file copy routine. The vulnerability stems from insufficient sanitization of the _display_name parameter when constructing file paths. An attacker with local access can manipulate this parameter to include directory traversal sequences (e.g., "../") to write files outside the intended cache directory. The attack requires local proximity to the device. The vulnerability has been patched in version 8.0.1 via commit c6900b1ed06fcc3ca4b09651348974ac5b95e4e6.
Affected products
- achorein expo-share-intent up to 8.0.0
Timeline
- 2026-08-24: disclosed
- 2026-08-24: patched: Version 8.0.1 resolves the vulnerability