CVE-2026-11319: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in TickTick Limited TickTick for Android

CVE-2026-11319 describes a path traversal vulnerability in TickTick for Android (com.ticktick.task) version 8.2.2.0. The issue exists in the exported ShareReceiveActivity, which processes ACTION_SEND intents containing content:// URIs. A malicious local application can register a ContentProvider that returns a _display_name containing directory traversal sequences. TickTick's FileManager.getDisplayNameFromUri and AttachmentFileHelper.copyFileDirectly methods do not sanitize this value, resulting in files being written outside the intended attachment directory. This allows an attacker to write files to arbitrary locations on the device with the application's privileges.

An attacker with the ability to send intents to TickTick can write files to arbitrary locations on the device's filesystem with the permissions of the TickTick app. This could lead to unauthorized file modification or persistence of malicious files. However, exploitation requires local access and no user interaction is needed. The CVSS 4.0 score is 6.9 (medium severity), reflecting the local attack vector and the potential impact on confidentiality and integrity.

No vendor advisory or patch information is provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid installing untrusted local applications and restrict app permissions to limit exposure.