Threat Intelligence Database

The react-native-receive-sharing-intent library contains a path traversal vulnerability that allows a malicious co-resident application to write files outside the intended cache directory. This is achieved by supplying a crafted _display_name value with dot-dot path components via a malicious ContentProvider. Exploitation can lead to overwriting arbitrary files in the consuming app's private data directory, including databases, shared preferences, and cached configuration, with attacker-controlled content. The vulnerability has a high severity score of 7. No patch or official remediation has been confirmed yet.