CVE-2026-30290
Arbitrary File Overwrite in InTouch Contacts App Enables Code Execution
Publication date: 2026-03-31
Last updated on: 2026-04-07
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| intouchapp | intouch_contacts_&_caller_id | 6.38.1 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-22 | The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-30290 is an arbitrary file overwrite vulnerability in the InTouch Contacts & Caller ID app version 6.38.1. It occurs due to insufficient security validation during the file import process, which allows an attacker to manipulate the filename and content of imported files.
By exploiting path traversal techniques, an attacker can overwrite critical internal files within the app’s storage, including executable and configuration files.
This can lead to arbitrary code execution or exposure of sensitive information.
How can this vulnerability impact me? :
This vulnerability can have several severe impacts including:
- Arbitrary code execution, allowing attackers to run malicious code within the app.
- Exposure of sensitive information stored within the app.
- Denial of service or app malfunction, potentially causing the app to fail to launch or operate correctly.
- Privilege escalation, enabling attackers to gain higher access rights.
The attack requires minimal user interaction and can be triggered automatically when the victim opens a malicious app.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability involves arbitrary file overwrite via the file import process in InTouch Contacts & Caller ID app v6.38.1, exploiting path traversal to overwrite critical internal files.
Detection can focus on monitoring the app's file import activity for suspicious file names or paths that include traversal sequences (e.g., ../) and unexpected modifications to internal executable or configuration files.
Since the vulnerability is triggered by the component `com.intouchapp.activities.ext_share.ExternalShareActivity`, monitoring logs or app behavior related to this component may help detect exploitation attempts.
- Check for unexpected file changes in the app's storage directories, especially executable and configuration files.
- Use file integrity monitoring tools to detect unauthorized overwrites.
- On Android devices, use commands like `adb shell` to inspect app directories and check for suspicious files or modifications.
- Example commands (assuming Android debugging enabled):
- `adb shell run-as com.intouchapp ls -l /data/data/com.intouchapp/files/` to list files in app storage.
- `adb shell run-as com.intouchapp stat /data/data/com.intouchapp/files/<filename>` to check file metadata for suspicious changes.
- Monitor logs for activity related to `ExternalShareActivity` using `adb logcat | grep ExternalShareActivity`.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting or disabling the file import functionality in the InTouch Contacts & Caller ID app version 6.38.1 until a patch or update is available.
Avoid opening or importing files from untrusted sources to prevent exploitation via malicious file imports.
Monitor and restrict app permissions related to file access and external sharing to limit the attack surface.
If possible, update the app to a version where this vulnerability is fixed once available.
Consider using mobile device management (MDM) solutions to control app behavior and enforce security policies.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows attackers to overwrite critical internal files, potentially leading to arbitrary code execution or exposure of sensitive information.
Exposure of sensitive information due to this vulnerability could result in non-compliance with data protection regulations such as GDPR or HIPAA, which mandate the protection of personal and health-related data.
Additionally, arbitrary code execution and privilege escalation could compromise the integrity and confidentiality of data, further impacting compliance with these standards.