{"id":"CVE-2026-68509","kind":"vulnerability","aliases":["CVE-2026-68509"],"related":[],"title":"FairEmail for Android: crafted shared attachment name overwrites app data files","description":"FairEmail is a fully featured, open source, privacy-friendly email app for Android. Prior to 1.2325, shared attachment handling does not adequately sanitize an attacker-controlled filename before constructing its destination path. A local attacker-controlled app can therefore supply path components that escape the intended shared attachment directory and overwrite or corrupt files in the FairEmail private data directory, including account or message databases. Exploitation requires app lock using PIN or biometric authentication and user interaction to unlock FairEmail. This issue is fixed in version 1.2325.","summary":"FairEmail, an Android email app, does not sanitize attachment filenames supplied by another app before building the save path. A local app can use path components in the filename to overwrite files in FairEmail's private data directory, including account and message databases.","severity":"medium","cvss":6.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["android","fairemail","mobile","package"],"not_affected_if":["app-lock-disabled","fairemail-1.2325-or-later","no-malicious-local-app"],"how_to_check":"- Open FairEmail and check the version under Settings > About; the sources say versions before `1.2325` are affected.","fix":"- FairEmail: move to `1.2325` or later (sources state this is the fixed version).","status":"open","published_at":"2026-11-05T23:16:56+00:00","first_seen_at":"2026-11-05T23:48:39+00:00","triaged_at":"2026-11-05T23:49:45+00:00","updated_at":"2026-11-05T23:49:45+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-05T23:49:45Z","model":"claude-haiku-5-5","output":{"fix":"- FairEmail: move to `1.2325` or later (sources state this is the fixed version).","reach":"local","title":"FairEmail for Android: crafted shared attachment name overwrites app data files","impact":"medium","summary":"FairEmail, an Android email app, does not sanitize attachment filenames supplied by another app before building the save path. A local app can use path components in the filename to overwrite files in FairEmail's private data directory, including account and message databases.","audience":"everyone","category":"package","nicknames":[],"who_cares":["android","fairemail","mobile"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"local app overwrites FairEmail account and message databases","analyst_note":"","how_to_check":"- Open FairEmail and check the version under Settings > About; the sources say versions before `1.2325` are affected.","plain_action":"Update FairEmail to version 1.2325 or later from your app store or the F-Droid store.","needs_analyst":false,"not_affected_if":["fairemail-1.2325-or-later","app-lock-disabled","no-malicious-local-app"],"who_is_affected":"Users of FairEmail on Android before version 1.2325 who have app lock with PIN or biometrics enabled. Exploitation needs another app on the same device that can send a shared attachment and a user action to unlock FairEmail; devices without FairEmail or with the fixed version are not affected.","user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000697,"input_tokens":4342,"output_tokens":525,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-68509':14A,17A '1.2325':81C,154C 'account':61B,129C 'adequ':87C 'android':3A,18B,24B,78C 'anoth':34B 'app':9A,26B,35B,43B,76C,104C,135C 'attach':6A,30B,83C,115C 'attack':91C,102C 'attacker-control':90C,101C 'authent':141C 'biometr':140C 'build':37B 'compon':47B,109C 'construct':95C 'control':92C,103C 'corrupt':120C 'craft':4A 'cve':12A,15A 'data':10A,58B,126C 'databas':64B,132C 'destin':97C 'directori':59B,116C,127C 'email':25B,75C 'escap':111C 'exploit':133C 'fairemail':1A,19B,22B,55B,65C,124C,147C 'featur':69C 'file':11A,53B,121C 'filenam':31B,50B,93C 'fix':151C 'friend':74C 'fulli':68C 'handl':84C 'includ':60B,128C 'intend':113C 'interact':144C 'issu':149C 'local':42B,100C 'lock':136C 'messag':63B,131C 'mobil':20B 'name':7A 'open':70C 'overwrit':8A,52B,118C 'packag':21B 'path':40B,46B,98C,108C 'pin':138C 'prior':79C 'privaci':73C 'privacy-friend':72C 'privat':57B,125C 'requir':134C 'sanit':29B,88C 'save':39B 'share':5A,82C,114C 'sourc':71C 'suppli':32B,107C 'therefor':106C 'unlock':146C 'use':45B,137C 'user':143C 'version':153C","nicknames":[],"mitigations":[],"who_affected":"Users of FairEmail on Android before version 1.2325 who have app lock with PIN or biometrics enabled. Exploitation needs another app on the same device that can send a shared attachment and a user action to unlock FairEmail; devices without FairEmail or with the fixed version are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"everyone","plain_action":"Update FairEmail to version 1.2325 or later from your app store or the F-Droid store.","pkeys":[],"ptokens":[],"labels":["android","fairemail","medium","mobile","package"],"campaign_type":null,"first_public_at":"2026-07-04T14:00:34+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-68509","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68509","severity":null,"published_at":"2026-11-05T23:16:56+00:00","modified_at":"2026-11-05T23:16:56+00:00","first_seen_at":"2026-11-05T23:48:39+00:00","fetched_at":"2026-11-05T23:48:39+00:00","note":null}],"documents":[{"id":81480,"url":"https://github.com/M66B/FairEmail/commit/538523dded741f7a8a76052de9a69806d357c0f4","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":81481,"url":"https://github.com/M66B/FairEmail/releases/tag/1.2325","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":81482,"url":"https://github.com/M66B/FairEmail/security/advisories/GHSA-w92m-2v27-mvg9","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-07-04T14:00:34+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}