{"id":"CVE-2026-107029","kind":"vulnerability","aliases":["CVE-2026-107029"],"related":[],"title":"Pile v1.1.3: insecure permissions let attackers read and overwrite data","description":"Insecure permissions in rubenalfon Pile v1.1.3 allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and overwriting.","summary":"Pile v1.1.3 by rubenalfon exposes an exported component with insecure permissions. An unauthorized attacker can invoke it to access and overwrite data.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["other","pile","rubenalfon"],"not_affected_if":[],"how_to_check":"- Confirm whether the `Pile` app is in use and check its version is `1.1.3`\n- Review the app's exported components and their permission settings in the manifest","fix":null,"status":"open","published_at":"2026-10-29T16:17:48+00:00","first_seen_at":"2026-10-29T16:25:55+00:00","triaged_at":"2026-10-29T16:33:30+00:00","updated_at":"2026-10-29T16:33:30+00:00","category":"other","confidence":0.4,"triage":{"at":"2026-10-29T16:33:30Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Pile v1.1.3: insecure permissions let attackers read and overwrite data","impact":"high","summary":"Pile v1.1.3 by rubenalfon exposes an exported component with insecure permissions. An unauthorized attacker can invoke it to access and overwrite data.","audience":"developers","category":"other","nicknames":[],"who_cares":["pile","rubenalfon"],"confidence":0.4,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker reads and overwrites arbitrary data through an exported component","analyst_note":"Check the NVD entry and the Pile project repository for the affected component, reach, and any fixed version.","how_to_check":"- Confirm whether the `Pile` app is in use and check its version is `1.1.3`\n- Review the app's exported components and their permission settings in the manifest\n- unknown for other checks, the sources do not say","plain_action":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Only installations of rubenalfon Pile v1.1.3 that expose the affected exported component are described. The sources do not say which deployment or platform is involved, or whether the component is reachable from outside the device or network.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000644,"input_tokens":4083,"output_tokens":471,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-107029':13A,16A '-2026':12A,15A 'access':38B,60C 'allow':48C 'arbitrari':58C 'attack':6A,33B,50C 'compon':27B,55C 'cve':11A,14A 'data':10A,41B,59C 'export':26B,54C 'expos':24B 'insecur':3A,29B,42C 'invok':35B,52C 'lead':56C 'let':5A 'overwrit':9A,40B,62C 'permiss':4A,30B,43C 'pile':1A,18B,20B,46C 'read':7A 'rubenalfon':19B,23B,45C 'unauthor':32B,49C 'v1.1.3':2A,21B,47C","nicknames":[],"mitigations":[],"who_affected":"Only installations of rubenalfon Pile v1.1.3 that expose the affected exported component are described. The sources do not say which deployment or platform is involved, or whether the component is reachable from outside the device or network.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"first_public_at":"2026-10-29T16:17:48+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-107029","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107029","severity":null,"published_at":"2026-10-29T16:17:48+00:00","modified_at":"2026-10-29T16:17:48+00:00","first_seen_at":"2026-10-29T16:25:55+00:00","fetched_at":"2026-10-29T16:25:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}