CVE Watch4 de nov. de 2026

CVE-2026-58128

Alan: Health Insurance for Android (com.alanmobile) 1.450.0 contains a path traversal vulnerability that allows a co-resident malicious appl

CVSS

6.2

Média

EPSS

0.3%

p24

KEV

—

Exploit Today

0-100

Publicado: 4 de nov. de 2026 · Última mod.: 4 de nov. de 2026 · CWE-22

EPSS · 30d

Ainda não há histórico EPSS suficiente.

Descrição técnica

Alan: Health Insurance for Android (com.alanmobile) 1.450.0 contains a path traversal vulnerability that allows a co-resident malicious application to write attacker-controlled files outside the intended directory via the exported ShareReceiverActivity, which uses an unsanitized _display_name value from a shared content URI to construct the destination file path. Attackers can send a crafted ACTION_SEND intent with a _display_name containing directory traversal sequences to overwrite sensitive files within the app's sandbox such as databases, shared_prefs, and WebView data, enabling state tampering or code execution in the app's context without authentication or user interaction.

Referências oficiais

CVEs relacionados

CVECVSSEPSSKEVRExploitTítuloMod.

CVE-2026-920804.3 MÉD

—

———Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute pardus-boot-repair allows Path Traversal. This issue affects pardus-boot-repair: from 1.0.8 before 1.1.0.2h CVE-2026-1054226.6 MÉD

—

———In Apache James server prior version 3.9.1 relying on the SieveFileRepository incorect validation of file paths can result in path transversal, allowing to set arbitrary SIEVE scripts for other users. This allows a logged in attacker to set arbitrary SIEVE scripts for other users, resulting in denial of service or even traffic capture. Users are recommended to upgrade to version 3.9.1 which fixes this issue.3h CVE-2026-1146309.1 CRÍ

—

———The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the factory_reset function in all versions up to, and including, 3.3.8 This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). This vulnerability is exploitable via a two-step chain: an unauthenticated attacker first stores an arbitrary ticket_attachment_path value by submitting a ticket through the nopriv eh_crm_new_ticket_post AJAX endpoint (whose nonce is publicly exposed via the [wsdesk_support] shortcode), then triggers the factory_reset routine via a GET request to wp-admin/admin.php?page=wsdesk_factory_reset, which is guarded only by is_admin() — a request-type check — rather than a capability check, causing unlink() to be called on the attacker-supplied path.3h CVE-2026-685096.3 MÉD

—

———FairEmail is a fully featured, open source, privacy-friendly email app for Android. Prior to 1.2325, shared attachment handling does not adequately sanitize an attacker-controlled filename before constructing its destination path. A local attacker-controlled app can therefore supply path components that escape the intended shared attachment directory and overwrite or corrupt files in the FairEmail private data directory, including account or message databases. Exploitation requires app lock using PIN or biometric authentication and user interaction to unlock FairEmail. This issue is fixed in version 1.2325.16h CVE-2026-1029436.5 MÉD

—

———Dagu is a workflow engine with a built-in Web user interface. Prior to version 2.11.0, its MCP dagu_read operation with target dag_spec invokes the DAG specification API directly, bypassing the HTTP middleware introduced for CVE-2026-33344. The underlying resolver does not restrict resolved paths to configured DAG directories. An authenticated attacker with a viewer-role API key can supply an absolute or traversing path to read .yaml or .yml files outside those directories that are accessible to the Dagu process. The affected operation does not provide write or execution capability. This issue is fixed in version 2.11.0.16h