CVE-2026-84442: Path Traversal in MapQuest Get Directions App

This vulnerability in MapQuest Get Directions App 10.16.1 on Android involves a path traversal flaw in the getDataColumn function of ExpoShareIntentModule.kt within the com.mapquest.android.ace component. An attacker with local access can manipulate file paths due to insufficient validation, leading to potential unauthorized file access. The exploit code is publicly available. The vendor was contacted but did not provide any response or patch. No cloud service is involved, and no known exploits are reported in the wild.

The vulnerability allows local attackers to perform path traversal, potentially accessing unauthorized files on the device. The impact is limited by the requirement for local access and low privileges needed. There is no indication of remote exploitation or elevation of privileges beyond local file access. The CVSS score of 4.8 reflects a medium severity impact.

No official patch or remediation is currently available as the vendor has not responded to the disclosure. Users should avoid granting local access to untrusted parties and monitor for updates from the vendor. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.