CVE-2026-18648

Received Received - Intake

Path Traversal in Blix Email Blue Mail Calendar App

Publication date: 2026-08-03

Last updated on: 2026-08-03

Assigner: VulDB

Description

A vulnerability was detected in Blix Email Blue Mail Calendar App 2.2.305. Impacted is the function FileDirectory.getDataColumn/FileDirectory.getFileFromUri of the component react-native-receive-sharing-intent. The manipulation of the argument _display_name results in path traversal. The attack is only possible with local access. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-03

Last Modified

2026-08-03

Generated

2026-08-04

AI Q&A

2026-08-04

EPSS Evaluated

N/A

NVD

CVE-2026-18648

Affected Vendors & Products

Vendor	Product	Version / Range
blix	email_blue_mail_calendar_app	2.2.305

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

This vulnerability is a path traversal issue in Blix Email Blue Mail Calendar App 2.2.305. It exists in the FileDirectory.getDataColumn and FileDirectory.getFileFromUri functions of the react-native-receive-sharing-intent component. The flaw allows manipulation of the _display_name argument to perform path traversal, enabling unauthorized access to files on the local system.

Detection Guidance

Since this vulnerability requires local access and involves path traversal in the react-native-receive-sharing-intent component, detection may involve checking for unusual file access patterns or suspicious URI handling in the Blix Email Blue Mail Calendar App. No specific commands are provided in the context.

Impact Analysis

An attacker with local access could exploit this to read sensitive files outside the intended directory. This may lead to unauthorized data exposure, including personal or application data. The exploit is public, increasing the risk of real-world attacks.

Compliance Impact

This vulnerability could lead to unauthorized data access, violating GDPR's data protection principles and HIPAA's safeguards for protected health information. Non-compliance may result in legal penalties, reputational damage, and loss of trust.

Mitigation Strategies

Immediately update the Blix Email Blue Mail Calendar App to the latest version if available. If no update exists, consider uninstalling the app until a patch is released. Restrict local access to systems running the vulnerable app and monitor for unusual file access activities.

Hi! I’m here to help you understand CVE-2026-18648. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70