{"id":"CVE-2026-58128","kind":"vulnerability","aliases":["CVE-2026-58128"],"related":[],"title":"Alan Android health insurance app: path traversal lets another app overwrite files","description":"Alan: Health Insurance for Android (com.alanmobile) 1.450.0 contains a path traversal vulnerability that allows a co-resident malicious application to write attacker-controlled files outside the intended directory via the exported ShareReceiverActivity, which uses an unsanitized _display_name value from a shared content URI to construct the destination file path. Attackers can send a crafted ACTION_SEND intent with a _display_name containing directory traversal sequences to overwrite sensitive files within the app's sandbox such as databases, shared_prefs, and WebView data, enabling state tampering or code execution in the app's context without authentication or user interaction.","summary":"The Alan Android app (com.alanmobile version 1.450.0) exports a share receiver activity that builds a file path from an unsanitized display name, so a malicious co-installed app can write files outside the intended directory. An attacker can overwrite databases, preferences and WebView data inside the app's sandbox, enabling state tampering or code execution in the app's context.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["alan","android","mobile","other"],"not_affected_if":["no-malicious-coresident-app","other-app-versions"],"how_to_check":"- Check the installed Alan app version on the Android device or in the app's build metadata for `com.alanmobile` `1.450.0`\n- Review whether your app's exported activities such as ShareReceiverActivity are reachable by other apps in the manifest","fix":null,"status":"open","published_at":"2026-11-04T22:18:07+00:00","first_seen_at":"2026-11-04T23:08:49+00:00","triaged_at":"2026-11-04T23:09:56+00:00","updated_at":"2026-11-04T23:09:56+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-04T23:09:56Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Alan Android health insurance app: path traversal lets another app overwrite files","impact":"medium","summary":"The Alan Android app (com.alanmobile version 1.450.0) exports a share receiver activity that builds a file path from an unsanitized display name, so a malicious co-installed app can write files outside the intended directory. An attacker can overwrite databases, preferences and WebView data inside the app's sandbox, enabling state tampering or code execution in the app's context.","audience":"everyone","category":"other","nicknames":[],"who_cares":["android","alan","mobile"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker overwrites app databases and WebView data, enabling code execution in-app","analyst_note":"Confirm the fixed version and vendor update from the Alan release notes or the VulnCheck advisory at www.vulncheck.com.","how_to_check":"- Check the installed Alan app version on the Android device or in the app's build metadata for `com.alanmobile` `1.450.0`\n- Review whether your app's exported activities such as ShareReceiverActivity are reachable by other apps in the manifest","plain_action":"If you use the Alan health insurance app on Android, update it to the newest version from the Play Store once the vendor releases a fix.","needs_analyst":true,"not_affected_if":["other-app-versions","no-malicious-coresident-app"],"who_is_affected":"Users of the Alan Android app version 1.450.0 are exposed when another app installed on the same device sends a crafted share intent to the exported ShareReceiverActivity. Installs of other versions and devices without a malicious co-resident app are not shown to be affected by the sources. unknown for any fixed version.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"unknown"},"cost_usd":0.000757,"input_tokens":4368,"output_tokens":641,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-58128':15A,18A '1.450.0':28B,89C 'action':140C 'activ':33B 'alan':1A,19B,23B,83C 'allow':96C 'android':2A,20B,24B,87C 'anoth':9A 'app':5A,10A,25B,50B,69B,80B,157C,176C 'applic':102C 'attack':59B,106C,135C 'attacker-control':105C 'authent':180C 'build':35B 'co':48B,99C 'co-instal':47B 'co-resid':98C 'code':76B,172C 'com.alanmobile':26B,88C 'construct':130C 'contain':90C,147C 'content':127C 'context':82B,178C 'control':107C 'craft':139C 'cve':13A,16A 'data':66B,167C 'databas':62B,162C 'destin':132C 'directori':57B,112C,148C 'display':42B,121C,145C 'enabl':72B,168C 'execut':77B,173C 'export':29B,115C 'file':12A,37B,53B,108C,133C,154C 'health':3A,84C 'insid':67B 'instal':49B 'insur':4A,85C 'intend':56B,111C 'intent':142C 'interact':183C 'let':8A 'malici':46B,101C 'mobil':21B 'name':43B,122C,146C 'outsid':54B,109C 'overwrit':11A,61B,152C 'path':6A,38B,92C,134C 'pref':164C 'prefer':63B 'receiv':32B 'resid':100C 'sandbox':71B,159C 'send':137C,141C 'sensit':153C 'sequenc':150C 'share':31B,126C,163C 'sharereceiveract':116C 'state':73B,169C 'tamper':74B,170C 'travers':7A,93C,149C 'unsanit':41B,120C 'uri':128C 'use':118C 'user':182C 'valu':123C 'version':27B 'via':113C 'vulner':94C 'webview':65B,166C 'within':155C 'without':179C 'write':52B,104C","nicknames":[],"mitigations":[],"who_affected":"Users of the Alan Android app version 1.450.0 are exposed when another app installed on the same device sends a crafted share intent to the exported ShareReceiverActivity. Installs of other versions and devices without a malicious co-resident app are not shown to be affected by the sources. unknown for any fixed version.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":"If you use the Alan health insurance app on Android, update it to the newest version from the Play Store once the vendor releases a fix.","pkeys":[],"ptokens":[],"labels":["alan","android","medium","mobile","other"],"campaign_type":null,"first_public_at":"2026-11-04T22:18:07+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-58128","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-58128","severity":null,"published_at":"2026-11-04T22:18:07+00:00","modified_at":"2026-11-04T22:18:07+00:00","first_seen_at":"2026-11-04T23:08:49+00:00","fetched_at":"2026-11-04T23:08:49+00:00","note":null}],"documents":[{"id":71179,"url":"https://www.vulncheck.com/advisories/alan-health-insurance-for-android-path-traversal-via-sharereceiveractivity","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}