{"id":"CVE-2026-60117","kind":"vulnerability","aliases":["CVE-2026-60117"],"related":[],"title":"Flutter receive_sharing_intent on Android lets a rival app write files","description":"The Android implementation of the Flutter/Dart receive_sharing_intent package, versions 1.4.1 through 1.9.0, contains a path traversal vulnerability in FileDirectory.getDataColumn that allows a malicious co-resident application to write files outside the intended cache directory by supplying a crafted _display_name value from an untrusted ContentProvider. Attackers can use a path-shaped display name ../databases/proof.txt combined with a controlled content stream to write to arbitrary locations within the receiving application's private sandbox under its UID, achieving file overwrite without user interaction.","summary":"The Android code of the Flutter package receive_sharing_intent, versions 1.4.1 through 1.9.0, builds file paths from a display name supplied by another app's content provider without checking for ../ sequences. A malicious co-installed app can overwrite files inside the receiving app's private sandbox without user interaction.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"receive_sharing_intent","fixed":[],"affected":"","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["android","flutter","package","receive_sharing_intent"],"not_affected_if":["ios-only","not-using-package"],"how_to_check":"- Check the `receive_sharing_intent` version in `pubspec.lock` and confirm whether it falls in `1.4.1` through `1.9.0`.\n- Confirm whether the app's Android build includes that package.","fix":null,"status":"open","published_at":"2026-11-09T18:17:29+00:00","first_seen_at":"2026-11-09T18:27:56+00:00","triaged_at":"2026-11-09T18:29:17+00:00","updated_at":"2026-11-09T18:29:17+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-09T18:29:17Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Flutter receive_sharing_intent on Android lets a rival app write files","impact":"medium","summary":"The Android code of the Flutter package receive_sharing_intent, versions 1.4.1 through 1.9.0, builds file paths from a display name supplied by another app's content provider without checking for ../ sequences. A malicious co-installed app can overwrite files inside the receiving app's private sandbox without user interaction.","audience":"developers","category":"package","nicknames":[],"who_cares":["flutter","android","receive_sharing_intent"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"another installed app overwrites files in the app's private storage","analyst_note":"Confirm the package's registry (pub.dev, not PyPI) and find the fixed version on the vulncheck advisory or NVD entry.","how_to_check":"- Check the `receive_sharing_intent` version in `pubspec.lock` and confirm whether it falls in `1.4.1` through `1.9.0`.\n- Confirm whether the app's Android build includes that package.","plain_action":"","product_name":"receive_sharing_intent","needs_analyst":true,"not_affected_if":["ios-only","not-using-package"],"who_is_affected":"Android apps built with Flutter that use receive_sharing_intent between 1.4.1 and 1.9.0 are exposed to file overwrites from another installed app that shares content with them. Apps on other platforms, or on versions outside that range, are not affected by the sources' description. Apps that do not receive shared content through this package can skip it.","user_interaction":"no","product_ecosystem":"pypi","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000771,"input_tokens":4677,"output_tokens":606,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-60117':15A,18A '/databases/proof.txt':136C '1.4.1':39B,90C '1.9.0':41B,92C 'achiev':158C 'allow':101C 'android':6A,22B,29B,80C 'anoth':51B 'app':10A,52B,65B,72B 'applic':107C,151C 'arbitrari':146C 'attack':127C 'build':42B 'cach':114C 'check':57B 'co':63B,105C 'co-instal':62B 'co-resid':104C 'code':30B 'combin':137C 'contain':93C 'content':54B,141C 'contentprovid':126C 'control':140C 'craft':119C 'cve':13A,16A 'directori':115C 'display':47B,120C,134C 'file':12A,43B,68B,110C,159C 'filedirectory.getdatacolumn':99C 'flutter':1A,23B,33B 'flutter/dart':84C 'implement':81C 'insid':69B 'instal':64B 'intend':113C 'intent':4A,21A,27B,37B,87C 'interact':78B,163C 'let':7A 'locat':147C 'malici':61B,103C 'name':48B,121C,135C 'outsid':111C 'overwrit':67B,160C 'packag':24B,34B,88C 'path':44B,95C,132C 'path-shap':131C 'privat':74B,153C 'provid':55B 'receiv':2A,25B,35B,71B,85C,150C 'receive':19A 'resid':106C 'rival':9A 'sandbox':75B,154C 'sequenc':59B 'shape':133C 'share':3A,26B,36B,86C 'sharing':20A 'stream':142C 'suppli':49B,117C 'travers':96C 'uid':157C 'untrust':125C 'use':129C 'user':77B,162C 'valu':122C 'version':38B,89C 'vulner':97C 'within':148C 'without':56B,76B,161C 'write':11A,109C,144C","nicknames":[],"mitigations":[],"who_affected":"Android apps built with Flutter that use receive_sharing_intent between 1.4.1 and 1.9.0 are exposed to file overwrites from another installed app that shares content with them. Apps on other platforms, or on versions outside that range, are not affected by the sources' description. Apps that do not receive shared content through this package can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"pkeys":["receivesharingintent"],"ptokens":["intent","receive","sharing"],"labels":["android","flutter","medium","package","pypi","receivesharingintent"],"campaign_type":null,"search_a":"'-2026':14A,17A '-60117':15A,18A 'android':6A 'app':10A 'cve':13A,16A 'file':12A 'flutter':1A 'intent':4A,21A 'let':7A 'receiv':2A 'receive':19A 'rival':9A 'share':3A 'sharing':20A 'write':11A","search_b":"'1.4.1':39B '1.9.0':41B 'android':22B,29B 'anoth':51B 'app':52B,65B,72B 'build':42B 'check':57B 'co':63B 'co-instal':62B 'code':30B 'content':54B 'display':47B 'file':43B,68B 'flutter':23B,33B 'insid':69B 'instal':64B 'intent':27B,37B 'interact':78B 'malici':61B 'name':48B 'overwrit':67B 'packag':24B,34B 'path':44B 'privat':74B 'provid':55B 'receiv':25B,35B,71B 'sandbox':75B 'sequenc':59B 'share':26B,36B 'suppli':49B 'user':77B 'version':38B 'without':56B,76B","search_c":"'/databases/proof.txt':136C '1.4.1':90C '1.9.0':92C 'achiev':158C 'allow':101C 'android':80C 'applic':107C,151C 'arbitrari':146C 'attack':127C 'cach':114C 'co':105C 'co-resid':104C 'combin':137C 'contain':93C 'content':141C 'contentprovid':126C 'control':140C 'craft':119C 'directori':115C 'display':120C,134C 'file':110C,159C 'filedirectory.getdatacolumn':99C 'flutter/dart':84C 'implement':81C 'intend':113C 'intent':87C 'interact':163C 'locat':147C 'malici':103C 'name':121C,135C 'outsid':111C 'overwrit':160C 'packag':88C 'path':95C,132C 'path-shap':131C 'privat':153C 'receiv':85C,150C 'resid':106C 'sandbox':154C 'shape':133C 'share':86C 'stream':142C 'suppli':117C 'travers':96C 'uid':157C 'untrust':125C 'use':129C 'user':162C 'valu':122C 'version':89C 'vulner':97C 'within':148C 'without':161C 'write':109C,144C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T18:17:29+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-60117","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-60117","severity":null,"published_at":"2026-11-09T18:17:29+00:00","modified_at":"2026-11-09T18:17:29+00:00","first_seen_at":"2026-11-09T18:27:56+00:00","fetched_at":"2026-11-09T18:27:56+00:00","note":null}],"documents":[{"id":108820,"url":"https://www.vulncheck.com/advisories/receive-sharing-intent-path-traversal-via-filedirectory","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}