CVE-2026-78196
Received Received - Intake

Path Traversal in achorein expo-share-intent

Publication date: 2026-08-24

Last updated on: 2026-08-24

Assigner: VulDB

Description
A security flaw has been discovered in achorein expo-share-intent up to 8.0.0. This affects the function getDataColumn of the file ExpoShareIntentModule.kt of the component Android File Copy Routine. The manipulation of the argument _display_name results in path traversal. The attack requires a local approach. Upgrading to version 8.0.1 is able to mitigate this issue. The patch is identified as c6900b1ed06fcc3ca4b09651348974ac5b95e4e6. The affected component should be upgraded.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-24
Last Modified
2026-08-24
Generated
2026-08-24
AI Q&A
2026-08-24
EPSS Evaluated
N/A
NVD
CVE-2026-78196
EUVD
EUVD-2026-64724

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
achorein expo-share-intent to 8.0.0 (inc)
achorein expo-share-intent 8.0.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a path traversal issue in the expo-share-intent library up to version 8.0.0. It occurs in the Android file copy routine where the _display_name argument in the getDataColumn function is manipulated to access files outside the intended cache directory. The attack requires local access and can be mitigated by upgrading to version 8.0.1.

Detection Guidance

This vulnerability is specific to Android applications using the expo-share-intent library versions up to 8.0.0. Detection involves checking if your app uses this library and if the version is below 8.0.1. Review the app's dependencies in package.json or build.gradle files for expo-share-intent. No network-specific commands are applicable as this is a local attack vector.

Impact Analysis

An attacker could exploit this to write files to unintended locations within the app's private data directory. This could lead to unauthorized data access, corruption, or execution of malicious files if combined with other vulnerabilities. The impact is limited to local attacks and requires no special permissions.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR or HIPAA as it is a local path traversal issue in an Android library. However, if exploited, it could potentially lead to unauthorized access to sensitive files within an app's private data directory, which might violate data protection principles under GDPR (e.g., integrity and confidentiality) or HIPAA (e.g., unauthorized access to protected health information). The impact depends on the app's use case and data handling practices.

Mitigation Strategies

Immediately upgrade the expo-share-intent library to version 8.0.1 or later in your Android application. Update the dependency in package.json or build.gradle and rebuild the app. Verify the patch by checking the commit c6900b1ed06fcc3ca4b09651348974ac5b95e4e6 is included in your build.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-78196. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart