This vulnerability in Blix Email Blue Mail Calendar App 2.2.305 involves improper handling of the _display_name argument in the FileDirectory.getDataColumn and FileDirectory.getFileFromUri functions of the react-native-receive-sharing-intent component. This allows a local attacker with limited privileges to perform path traversal attacks, potentially accessing unauthorized files. The attack requires local access and does not require user interaction. The vendor was contacted but did not respond, and no patch or official remediation has been published. The CVSS 4.0 base score is 4.8, indicating medium severity.

An attacker with local access and limited privileges can exploit this vulnerability to perform path traversal, potentially accessing files outside intended directories. This may lead to unauthorized information disclosure or local data compromise. The vulnerability does not require user interaction and has low complexity, but the impact is limited by the need for local access and limited privileges.

No official patch or remediation guidance is currently available from the vendor. Since the vendor has not responded and no fix is published, users should restrict local access to trusted users only and monitor for suspicious local activity. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance if it becomes available.