Executive brief
MapQuest Get Directions is a popular navigation and directions app for Android that relies on the expo-share-intent library to handle file sharing intents. A path traversal vulnerability in the getDataColumn function allows a malicious app to write arbitrary files to MapQuest's private directories (such as app cache or databases), potentially overwriting the app's session data, wiping authentication state, or corrupting stored data—resulting in denial of service or account takeover.
Technical details
The vulnerability is a path traversal flaw in the expo-share-intent library (versions 0.2.1–8.0.0), specifically in the getDataColumn function of ExpoShareIntentModule.kt in the component com.mapquest.android.ace. When an attacker's app sends a malicious Intent with ACTION_SEND and a crafted content:// Uri, the vulnerable code fails to sanitize the _display_name returned by a custom ContentProvider, allowing directory traversal sequences (e.g., ../databases/RKStorage) to reach sensitive app directories. The attack requires no permissions but does require the target app to be installed; the attacker sends an Intent to MapQuest's MainActivity with a custom content provider serving a malicious Uri. A successful exploit can overwrite the AsyncStorage SQLite database (causing forced logout and auth state corruption) or write arbitrary files to the app cache, with potential for code execution if future app versions add writable JS-bundle paths (e.g., via CodePush or expo-updates). Proof-of-concept code has been published, and the upstream expo-share-intent library has an unmerged fix (PR #221) as of the advisory date.
Affected products
- MapQuest Get Directions App 10.16.1
Timeline
- 2026-09-02: disclosed: CVE-2026-84442 published