CVE-2026-58460 describes a path traversal vulnerability in the react-native-receive-sharing-intent library by ajith-ab. The flaw allows an attacker app on the same device to exploit the consuming app's exported share-receiver activity by sending an explicit ACTION_SEND intent containing a crafted _display_name parameter with directory traversal sequences. This enables the attacker to write files outside the intended cache directory, potentially overwriting sensitive files such as databases and configuration files within the app's private data directory. The vulnerability does not require privileges or user interaction and has a CVSS 4.0 base score of 7. No vendor advisory or patch information is currently available.

An attacker controlling a malicious app on the same device can overwrite arbitrary files in the target app's private data directory, including critical files like databases, shared preferences, and cached configuration. This can lead to data corruption, unauthorized data modification, or persistent compromise of the target app's state. The vulnerability does not require privileges or user interaction, increasing its risk on affected devices.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider restricting or monitoring inter-app communication involving the react-native-receive-sharing-intent component and avoid exposing share-receiver activities to untrusted apps if possible.