---
id: "CVE-2026-58128"
kind: "vulnerability"
aliases: ["CVE-2026-58128"]
title: "Alan Android health insurance app: path traversal lets another app overwrite files"
severity: "medium"
cvss: 6.9
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["alan", "android", "mobile", "other"]
not_affected_if: ["no-malicious-coresident-app", "other-app-versions"]
published_at: "2026-11-04T22:18:07+00:00"
first_seen_at: "2026-11-04T23:08:49+00:00"
updated_at: "2026-11-04T23:09:56+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-58128", "first_seen_at": "2026-11-04T23:08:49+00:00"}]
exploit_sources: []
---

# Alan Android health insurance app: path traversal lets another app overwrite files

The Alan Android app (com.alanmobile version 1.450.0) exports a share receiver activity that builds a file path from an unsanitized display name, so a malicious co-installed app can write files outside the intended directory. An attacker can overwrite databases, preferences and WebView data inside the app's sandbox, enabling state tampering or code execution in the app's context.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Alan app version on the Android device or in the app's build metadata for `com.alanmobile` `1.450.0`
- Review whether your app's exported activities such as ShareReceiverActivity are reachable by other apps in the manifest

## Timeline

- 2026-11-04T23:08:49+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-58128

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/alan-health-insurance-for-android-path-traversal-via-sharereceiveractivity

## From the sources

Alan: Health Insurance for Android (com.alanmobile) 1.450.0 contains a path traversal vulnerability that allows a co-resident malicious application to write attacker-controlled files outside the intended directory via the exported ShareReceiverActivity, which uses an unsanitized _display_name value from a shared content URI to construct the destination file path. Attackers can send a crafted ACTION_SEND intent with a _display_name containing directory traversal sequences to overwrite sensitive files within the app's sandbox such as databases, shared_prefs, and WebView data, enabling state tampering or code execution in the app's context without authentication or user interaction.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_