CVE-2026-68509 · Package
NO FIX YET · SEE WHAT TO DO
FairEmail, an Android email app, does not sanitize attachment filenames supplied by another app before building the save path. A local app can use path components in the filename to overwrite files in FairEmail's private data directory, including account and message databases.
first public Jul 4, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Users of FairEmail on Android before version 1.2325 who have app lock with PIN or biometrics enabled. Exploitation needs another app on the same device that can send a shared attachment and a user action to unlock FairEmail; devices without FairEmail or with the fixed version are not affected.
Not affected if app-lock-disabled, fairemail-1.2325-or-later, no-malicious-local-app
Who cares android, fairemail, mobile
1.2325 are affected.1.2325 or later (sources state this is the fixed version).FairEmail is a fully featured, open source, privacy-friendly email app for Android. Prior to 1.2325, shared attachment handling does not adequately sanitize an attacker-controlled filename before constructing its destination path. A local attacker-controlled app can therefore supply path components that escape the intended shared attachment directory and overwrite or corrupt files in the FairEmail private data directory, including account or message databases. Exploitation requires app lock using PIN or biometric authentication and user interaction to unlock FairEmail. This issue is fixed in version 1.2325.
This page as ·
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.