CVE WatchOct 29, 2026

CVE-2026-107056

Insecure permissions in the io.file.importer.ImportActivity component of OpenTracks versionCode 6751 allows unauthorized attackers to inject

CVSS

—

No CVSS

EPSS

—

KEV

—

Exploit Today

—

0-100

Published: Oct 29, 2026 · Last modified: Oct 29, 2026

EPSS · 30d

Not enough EPSS history yet.

Technical description

Insecure permissions in the io.file.importer.ImportActivity component of OpenTracks versionCode 6751 allows unauthorized attackers to inject crafted tracking data into the victim's location database via a crafted SEND message.

Official references

codeberg.orghttps://codeberg.org/OpenTracksApp/OpenTracks
f-droid.orghttps://f-droid.org/packages/de.dennisguse.opentracks/
github.comhttps://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107056.md

Related CVEs

No related CVEs by CWE or product.