CVE-2026-78196CWE-22path-traversal

CVE-2026-78196

Medium · published August 24, 2026

CVSS v3.1
4.4
EPSS
0%
Percentile
6.3
In the wild
Unconfirmed
What it is

A security flaw has been discovered in achorein expo-share-intent up to 8.0.0. This affects the function getDataColumn of the file ExpoShareIntentModule.kt of the component Android File Copy Routine. The manipulation of the argument _display_name results in path traversal. The attack requires a local approach. Upgrading to version 8.0.1 is able to mitigate this issue. The patch is identified as c6900b1ed06fcc3ca4b09651348974ac5b95e4e6. The affected component should be upgraded.

The record
Technical detail
CVSS v3.1
4.4 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
CVSS v4.0
4.8 · CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X
EPSS
0.00172 · 6.3th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-08-24T09:16Z
References (8)
https://github.com/achorein/expo-share-intent/ · [email protected]https://github.com/achorein/expo-share-intent/commit/c6900b1ed06fcc3ca4b09651348974ac5b95e4e6 · [email protected]https://github.com/achorein/expo-share-intent/pull/221 · [email protected]https://github.com/achorein/expo-share-intent/releases/tag/v8.0.1 · [email protected]https://vuldb.com/cve/CVE-2026-78196 · [email protected]https://vuldb.com/submit/885425 · [email protected]https://vuldb.com/vuln/394573 · [email protected]https://vuldb.com/vuln/394573/cti · [email protected]
EPSS history
Timeline
  • 24 AUG 04:45Z
    achorein expo-share-intent Android File Copy Routine ExpoShareIntentModule.kt getDataColumn path traversal
    cvelistv5