Path Traversal Vulnerability in FairEmail for Android

CVE-2026-68509

What is CVE-2026-68509?

FairEmail, an open-source and privacy-friendly email client for Android, is vulnerable to a path traversal issue in its shared attachment handling feature. Before version 1.2325, the app fails to properly sanitize filenames controlled by an attacker when constructing the file destination path. This oversight allows local malicious applications to manipulate file paths, potentially leading to overwriting or corrupting files within the FairEmail private data directory, such as databases containing user accounts or messages. Note that successful exploitation necessitates that the app is locked using a PIN or biometric authentication, as well as user interaction to unlock FairEmail. The vulnerability has been addressed in version 1.2325.

References