CVE-2026-84442: Path Traversal in MapQuest Get Directions App

This vulnerability involves a path traversal issue in the getDataColumn function within the ExpoShareIntentModule.kt file of the MapQuest Get Directions App for Android (version 10.16.1). An attacker with local access can manipulate input to traverse directories improperly, potentially accessing unauthorized files or data. The vulnerability does not require user interaction but does require local privileges. The vendor was notified but has not provided any response or patch. The CVSS 4.8 score reflects a medium severity with local attack vector and low privileges required.

An attacker with local access to the device can exploit this path traversal vulnerability to access files outside the intended directory scope. This could lead to unauthorized disclosure of sensitive information stored on the device. However, the impact is limited by the requirement for local access and low privileges, and there is no indication of remote exploitation or privilege escalation.

No official fix or patch is currently available from the vendor, and the vendor has not responded to disclosure attempts. Users should avoid granting local access to untrusted parties and monitor for updates from the vendor. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.