Path Traversal Vulnerability in React Native Receive Sharing Intent by Ajith Ab

CVE-2026-58460

What is CVE-2026-58460?

The react-native-receive-sharing-intent library is susceptible to a path traversal vulnerability. This flaw permits a co-resident malicious application to exploit the system by manipulating the _display_name value to include dot-dot path components. Through this vulnerability, attackers can leverage a malicious ContentProvider to conduct an explicit ACTION_SEND intent, allowing them to write files outside of the intended cache directory. This could potentially compromise sensitive data within the consuming application's private data directory, including databases, shared preferences, and cached configurations, by overwriting them with arbitrary, attacker-controlled content.

References