---
id: "CVE-2026-60117"
page: "https://infrastack.ai/live/CVE-2026-60117"
kind: "vulnerability"
aliases: ["CVE-2026-60117"]
title: "Flutter receive_sharing_intent on Android lets a rival app write files"
severity: "medium"
cvss: 6.9
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "receive_sharing_intent", "fixed": [], "affected": "", "ecosystem": "pypi"}]
ecosystems: ["pypi"]
tags: ["android", "flutter", "package", "receive_sharing_intent"]
not_affected_if: ["ios-only", "not-using-package"]
published_at: "2026-11-09T18:17:29+00:00"
first_seen_at: "2026-11-09T18:27:56+00:00"
updated_at: "2026-11-09T18:29:17+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-60117", "first_seen_at": "2026-11-09T18:27:56+00:00"}]
exploit_sources: []
---

# Flutter receive_sharing_intent on Android lets a rival app write files

Link for people: https://infrastack.ai/live/CVE-2026-60117 (this .md is for agents)

The Android code of the Flutter package receive_sharing_intent, versions 1.4.1 through 1.9.0, builds file paths from a display name supplied by another app's content provider without checking for ../ sequences. A malicious co-installed app can overwrite files inside the receiving app's private sandbox without user interaction.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- pypi:receive_sharing_intent affected range not listed fixed no fixed version listed

## How to check

- Check the `receive_sharing_intent` version in `pubspec.lock` and confirm whether it falls in `1.4.1` through `1.9.0`.
- Confirm whether the app's Android build includes that package.

## Timeline

- 2026-11-09T18:27:56+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-60117

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/receive-sharing-intent-path-traversal-via-filedirectory

## From the sources

The Android implementation of the Flutter/Dart receive_sharing_intent package, versions 1.4.1 through 1.9.0, contains a path traversal vulnerability in FileDirectory.getDataColumn that allows a malicious co-resident application to write files outside the intended cache directory by supplying a crafted _display_name value from an untrusted ContentProvider. Attackers can use a path-shaped display name ../databases/proof.txt combined with a controlled content stream to write to arbitrary locations within the receiving application's private sandbox under its UID, achieving file overwrite without user interaction.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_