Path Traversal Vulnerability in Alan: Health Insurance for Android
CVE-2026-58128

6.9MEDIUM

Key Information:

Vendor

Alan Health

Status
Alan: Health Insurance
Vendor
CVE Published:
4 November 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-58128?

The Alan: Health Insurance for Android app version 1.450.0 has a vulnerability that enables a malicious co-resident application to exploit the exported ShareReceiverActivity. By manipulating the _display_name value from a shared content URI through a crafted ACTION_SEND intent, attackers can execute directory traversal sequences. This allows them to write attacker-controlled files outside of the intended application directory. Consequently, sensitive files like databases, shared preferences, and WebView data within the app's sandbox may be overwritten, leading to potential state tampering or unauthorized code execution within the app's context, all without the need for user authentication or interaction.

Affected Version(s)

Alan: Health Insurance 1.450.0

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-58128 - Proof of Concept

References

https://github.com/actuator/com.alanmobile
technical-descriptionexploit
https://play.google.com/store/apps/details?id=com.alanmobile
product
https://www.vulncheck.com/advisories/alan-health-insuranc...
third-party-advisory

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Edward "Actuator" Warren
.