{"id":"CVE-2026-107025","kind":"vulnerability","aliases":["CVE-2026-107025"],"related":[],"title":"WikiAndPad alpha: insecure permissions let attackers export app data","description":"Insecure permissions in WikiAndPad alpha/beta v0.2alpha03 (versionCode 200300) allows unauthorized attackers to export the application's data.","summary":"WikiAndPad alpha/beta v0.2alpha03 (versionCode 200300) has insecure permissions that let an unauthorized attacker export the application's data. The sources give no details on how the export is triggered.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["android","other","wikiandpad"],"not_affected_if":["other-versions"],"how_to_check":"- Check the installed WikiAndPad version against `v0.2alpha03` (versionCode `200300`)","fix":null,"status":"open","published_at":"2026-10-29T16:17:48+00:00","first_seen_at":"2026-10-29T16:25:55+00:00","triaged_at":"2026-10-29T16:33:34+00:00","updated_at":"2026-10-29T16:33:34+00:00","category":"other","confidence":0.4,"triage":{"at":"2026-10-29T16:33:34Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"WikiAndPad alpha: insecure permissions let attackers export app data","impact":"medium","summary":"WikiAndPad alpha/beta v0.2alpha03 (versionCode 200300) has insecure permissions that let an unauthorized attacker export the application's data. The sources give no details on how the export is triggered.","audience":"everyone","category":"other","nicknames":[],"who_cares":["wikiandpad","android"],"confidence":0.4,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Unauthorized attacker exports the application's stored wiki data","analyst_note":"Confirm the vulnerable access path, whether a fix exists, and the reach of the export, from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-107025.","how_to_check":"- Check the installed WikiAndPad version against `v0.2alpha03` (versionCode `200300`)\n- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["other-versions"],"who_is_affected":"WikiAndPad alpha/beta builds at v0.2alpha03 (versionCode 200300) are described as affected. The sources do not say which configurations or access paths are exposed, or whether the export needs a device on the same network or access to the app.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.00066,"input_tokens":4087,"output_tokens":503,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-107025':12A,15A '-2026':11A,14A '200300':23B,55C 'allow':56C 'alpha':2A 'alpha/beta':20B,52C 'android':16B 'app':8A 'applic':34B,62C 'attack':6A,31B,58C 'cve':10A,13A 'data':9A,36B,64C 'detail':41B 'export':7A,32B,45B,60C 'give':39B 'insecur':3A,25B,48C 'let':5A,28B 'permiss':4A,26B,49C 'sourc':38B 'trigger':47B 'unauthor':30B,57C 'v0.2alpha03':21B,53C 'versioncod':22B,54C 'wikiandpad':1A,18B,19B,51C","nicknames":[],"mitigations":[],"who_affected":"WikiAndPad alpha/beta builds at v0.2alpha03 (versionCode 200300) are described as affected. The sources do not say which configurations or access paths are exposed, or whether the export needs a device on the same network or access to the app.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":null,"first_public_at":"2026-10-29T16:17:48+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-107025","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107025","severity":null,"published_at":"2026-10-29T16:17:48+00:00","modified_at":"2026-10-29T16:17:48+00:00","first_seen_at":"2026-10-29T16:25:55+00:00","fetched_at":"2026-10-29T16:25:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}