---
id: "CVE-2026-68509"
page: "https://infrastack.ai/live/CVE-2026-68509"
kind: "vulnerability"
aliases: ["CVE-2026-68509"]
title: "FairEmail for Android: crafted shared attachment name overwrites app data files"
severity: "medium"
cvss: 6.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["android", "fairemail", "mobile", "package"]
not_affected_if: ["app-lock-disabled", "fairemail-1.2325-or-later", "no-malicious-local-app"]
published_at: "2026-11-05T23:16:56+00:00"
first_seen_at: "2026-11-05T23:48:39+00:00"
updated_at: "2026-11-05T23:49:45+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-68509", "first_seen_at": "2026-11-05T23:48:39+00:00"}]
exploit_sources: []
---

# FairEmail for Android: crafted shared attachment name overwrites app data files

Link for people: https://infrastack.ai/live/CVE-2026-68509 (this .md is for agents)

FairEmail, an Android email app, does not sanitize attachment filenames supplied by another app before building the save path. A local app can use path components in the filename to overwrite files in FairEmail's private data directory, including account and message databases.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Open FairEmail and check the version under Settings > About; the sources say versions before `1.2325` are affected.

## Fix

- FairEmail: move to `1.2325` or later (sources state this is the fixed version).

## Timeline

- 2026-11-05T23:48:39+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-68509

## Documents

- [advisory] Vendor advisory: github.com https://github.com/M66B/FairEmail/security/advisories/GHSA-w92m-2v27-mvg9
- [fix] Patch: github.com https://github.com/M66B/FairEmail/commit/538523dded741f7a8a76052de9a69806d357c0f4
- [fix] Release notes: github.com https://github.com/M66B/FairEmail/releases/tag/1.2325

## From the sources

FairEmail is a fully featured, open source, privacy-friendly email app for Android. Prior to 1.2325, shared attachment handling does not adequately sanitize an attacker-controlled filename before constructing its destination path. A local attacker-controlled app can therefore supply path components that escape the intended shared attachment directory and overwrite or corrupt files in the FairEmail private data directory, including account or message databases. Exploitation requires app lock using PIN or biometric authentication and user interaction to unlock FairEmail. This issue is fixed in version 1.2325.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_