---
id: "CVE-2026-107052"
kind: "vulnerability"
aliases: ["CVE-2026-107052"]
title: "ProjectMAXS MAXS FileRead module lets attackers read files outside sandbox"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["android", "mobile", "other", "projectmaxs"]
not_affected_if: ["component-not-installed"]
published_at: "2026-10-29T17:17:57+00:00"
first_seen_at: "2026-10-29T17:26:16+00:00"
updated_at: "2026-10-29T17:28:07+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107052", "first_seen_at": "2026-10-29T17:26:16+00:00"}]
---

# ProjectMAXS MAXS FileRead module lets attackers read files outside sandbox

The MAXS Module FileRead component, version code 27, exposes its AIDL interface without proper permission checks. An unauthorized attacker can read arbitrary files outside the app sandbox by supplying an absolute path.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the MAXS Module FileRead component (ProjectMAXS) is installed in the app, at `versionCode 27`

## Timeline

- 2026-10-29T17:26:16+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-107052

## From the sources

Insecure permissions in the AIDL interface of ProjectMAXS MAXS Module FileRead versionCode 27 allows unauthorized attackers to arbitrarily reead files outside of the sandbox via providing an absolute path.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_