CVE-2026-58460 is a path traversal vulnerability in the ajith-ab react-native-receive-sharing-intent library. The vulnerability arises because the library does not properly restrict pathname inputs, allowing a malicious co-resident application to supply a crafted _display_name containing directory traversal sequences. By firing an explicit ACTION_SEND intent at the consuming app's exported share-receiver activity, an attacker can overwrite arbitrary files in the app's private data directory, potentially compromising app data integrity and confidentiality. The CVSS 4.0 base score is 7.0, indicating high severity, with local attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality and integrity.

An attacker with a malicious app on the same device can overwrite arbitrary files in the target app's private data directory, including sensitive files such as databases, shared preferences, and cached configuration. This can lead to data corruption, loss of confidentiality, and potentially unauthorized control or manipulation of the app's behavior or data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting or monitoring intents sent to the app's exported share-receiver activity to prevent malicious inputs. Avoid exposing this component unnecessarily and validate or sanitize input values such as _display_name to prevent path traversal sequences.