{"id":"CVE-2026-11319","kind":"vulnerability","aliases":["CVE-2026-11319"],"related":[],"title":"TickTick Android app: exported share receiver lets local apps write arbitrary files","description":"TickTick Android application (com.ticktick.task) 8.2.2.0 contains a path traversal vulnerability in its exported ShareReceiveActivity that allows a malicious local application to write files outside the intended attachment directory by supplying a crafted content:// URI with a traversal filename via ACTION_SEND intents. A malicious application can register a ContentProvider returning a _display_name value containing traversal sequences, which is passed unsanitized through FileManager.getDisplayNameFromUri and AttachmentFileHelper.copyFileDirectly, causing automatic file writes to attacker-chosen locations with TickTick's application privileges.","summary":"The TickTick Android app (com.ticktick.task, version 8.2.2.0) exports a share-receiving activity that trusts the display name supplied by a content provider. A malicious installed app can make TickTick write attachment files to attacker-chosen paths with TickTick's privileges.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["android","mobile","package","ticktick"],"not_affected_if":["ios-only","no-untrusted-apps-installed","web-only"],"how_to_check":"- Check the installed TickTick version in Settings > Apps > TickTick, or with `adb shell dumpsys package com.ticktick.task | grep versionName`, and see whether it reads `8.2.2.0`.","fix":"- Update TickTick on Android to a release newer than `8.2.2.0`; the sources do not name the fixed version, so check the Play Store listing or the vendor notes.","status":"open","published_at":"2026-10-19T18:17:05+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","triaged_at":"2026-10-25T03:40:43+00:00","updated_at":"2026-10-25T03:40:43+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:40:43Z","model":"claude-haiku-5-5","output":{"fix":"- Update TickTick on Android to a release newer than `8.2.2.0`; the sources do not name the fixed version, so check the Play Store listing or the vendor notes.","reach":"local","title":"TickTick Android app: exported share receiver lets local apps write arbitrary files","impact":"medium","summary":"The TickTick Android app (com.ticktick.task, version 8.2.2.0) exports a share-receiving activity that trusts the display name supplied by a content provider. A malicious installed app can make TickTick write attachment files to attacker-chosen paths with TickTick's privileges.","category":"package","nicknames":[],"who_cares":["android","mobile","ticktick"],"confidence":0.6,"needs_auth":"no","worst_case":"Malicious local app writes arbitrary files with TickTick's app privileges","analyst_note":"Confirm the fixed TickTick Android version and whether a vendor advisory exists; sources only cite NVD.","how_to_check":"- Check the installed TickTick version in Settings > Apps > TickTick, or with `adb shell dumpsys package com.ticktick.task | grep versionName`, and see whether it reads `8.2.2.0`.","needs_analyst":true,"not_affected_if":["ios-only","web-only","no-untrusted-apps-installed"],"who_is_affected":"Android users who have TickTick 8.2.2.0 installed and also have another app installed that could be malicious. The flaw needs a local app on the same device to send a crafted share intent, so teams that manage Android devices should look at installed app versions. Users on iOS, the web, or other TickTick versions are not covered by this description.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"unknown"},"cost_usd":0.000642,"input_tokens":3436,"output_tokens":597,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-11319':15A,18A '-2026':14A,17A '8.2.2.0':29B,69C 'action':103C 'activ':35B 'allow':80C 'android':2A,19B,25B,66C 'app':3A,9A,26B,49B 'applic':67C,84C,108C,141C 'arbitrari':11A 'attach':54B,91C 'attachmentfilehelper.copyfiledirectly':128C 'attack':58B,135C 'attacker-chosen':57B,134C 'automat':130C 'caus':129C 'chosen':59B,136C 'com.ticktick.task':27B,68C 'contain':70C,118C 'content':44B 'contentprovid':112C 'craft':96C 'cve':13A,16A 'directori':92C 'display':39B,115C 'export':4A,30B,77C 'file':12A,55B,87C,131C 'filemanager.getdisplaynamefromuri':126C 'filenam':101C 'instal':48B 'intend':90C 'intent':105C 'let':7A 'local':8A,83C 'locat':137C 'make':51B 'malici':47B,82C,107C 'mobil':20B 'name':40B,116C 'outsid':88C 'packag':21B 'pass':123C 'path':60B,72C 'privileg':64B,142C 'provid':45B 'receiv':6A,34B 'regist':110C 'return':113C 'send':104C 'sequenc':120C 'share':5A,33B 'share-receiv':32B 'sharereceiveact':78C 'suppli':41B,94C 'ticktick':1A,22B,24B,52B,62B,65C,139C 'travers':73C,100C,119C 'trust':37B 'unsanit':124C 'uri':97C 'valu':117C 'version':28B 'via':102C 'vulner':74C 'write':10A,53B,86C,132C","nicknames":[],"mitigations":[],"who_affected":"Android users who have TickTick 8.2.2.0 installed and also have another app installed that could be malicious. The flaw needs a local app on the same device to send a crafted share intent, so teams that manage Android devices should look at installed app versions. Users on iOS, the web, or other TickTick versions are not covered by this description.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T18:17:05+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-11319","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-11319","severity":null,"published_at":"2026-10-19T18:17:05+00:00","modified_at":"2026-10-22T21:17:17+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}