Path Traversal Vulnerability in Blix Email Blue Mail Calendar App
CVE-2026-18648

4.8MEDIUM

Key Information:

Vendor: Blix
Status: Email Blue Mail Calendar App
Vendor: CVE Published:; 3 August 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-18648?

A vulnerability has been identified in the Blix Email Blue Mail Calendar App affecting version 2.2.305. This issue resides in the FileDirectory.getDataColumn and FileDirectory.getFileFromUri functions within the react-native-receive-sharing-intent component. An adversary with local access can exploit the vulnerability by manipulating the argument _display_name, leading to a path traversal attack. The exploit has been publicly disclosed, and the vendor has been alerted but did not respond. Users should assess the potential risks associated with this vulnerability.

Affected Version(s)

Email Blue Mail Calendar App 2.2.305

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-18648 - Proof of Concept