Path Traversal Vulnerability in Flutter/Dart Package for Android by Google

CVE-2026-60117

What is CVE-2026-60117?

The receive_sharing_intent package for Flutter/Dart, specifically in versions 1.4.1 to 1.9.0, is vulnerable to a path traversal issue. This flaw exists in the FileDirectory.getDataColumn method, enabling a malicious co-resident application to exploit it by crafting a _display_name value sourced from an untrusted ContentProvider. By utilizing a specially constructed display name like '../databases/proof.txt', an attacker can manipulate the app to write files outside its intended cache directory. This allows unauthorized file writes within the private sandbox of the receiving application, leading to potential data overwrites without any user interaction.

References