CVE-2026-11319
Received Received - Intake

Path Traversal in TickTick Android App

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: VulnCheck

Description
TickTick Android application (com.ticktick.task) 8.2.2.0 contains a path traversal vulnerability in its exported ShareReceiveActivity that allows a malicious local application to write files outside the intended attachment directory by supplying a crafted content:// URI with a traversal filename via ACTION_SEND intents. A malicious application can register a ContentProvider returning a _display_name value containing traversal sequences, which is passed unsanitized through FileManager.getDisplayNameFromUri and AttachmentFileHelper.copyFileDirectly, causing automatic file writes to attacker-chosen locations with TickTick's application privileges.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-19
Last Modified
2026-10-19
Generated
2026-10-19
AI Q&A
2026-10-19
EPSS Evaluated
N/A
NVD
CVE-2026-11319
EUVD
EUVD-2026-104525

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
TickTick Limited TickTick for Android 8.2.2.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a path traversal vulnerability in the TickTick Android app (version 8.2.2.0) where a malicious local app can write files outside the intended attachment directory by sending a crafted content:// URI with traversal sequences like ../ in the filename through ACTION_SEND intents. The app's ShareReceiveActivity component processes these URIs without properly sanitizing the filenames, allowing attackers to exploit it to write files with TickTick's privileges.

Detection Guidance

Detecting this vulnerability requires checking if the TickTick Android app version 8.2.2.0 or earlier is installed and analyzing its exported components. Inspect the app's manifest for exported ShareReceiveActivity and verify if it handles content:// URIs without proper path sanitization. Use static analysis tools like MobSF or JADX to review the AttachmentFileHelper.copyFileDirectly and FileManager.getDisplayNameFromUri functions for path traversal flaws.

Impact Analysis

If exploited, this vulnerability could allow a malicious app on your device to overwrite or create files in locations outside TickTick's intended attachment directory using the app's permissions. This could lead to unauthorized file modifications, potential data corruption, or even execution of malicious code with TickTick's privileges, though user interaction is limited to the initial intent processing.

Compliance Impact

This vulnerability could potentially violate compliance with standards like GDPR and HIPAA by allowing unauthorized file writes outside intended directories. Attackers could create or overwrite files with TickTick's privileges, potentially accessing or modifying sensitive user data stored by the application. This may lead to unauthorized data exposure or modification, which are key concerns under GDPR and HIPAA.

Mitigation Strategies

Immediately update the TickTick Android app to the latest version beyond 8.2.2.0. If an update is unavailable, uninstall the app until a patch is released. Monitor for unusual file writes in system directories and restrict app installations to trusted sources. Disable the app's ability to receive shared files via intents if possible.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-11319. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart