FairEmail: Path traversal in shared attachment handling can write files outside the intended shared directory

Özet

Türkçe özeti yalnızca kritik ve yüksek önemdeki açıklar için hazırlıyoruz. Bu açık için kaynağın kendi açıklamasını gösteriyoruz.

FairEmail is a fully featured, open source, privacy-friendly email app for Android. Prior to 1.2325, shared attachment handling does not adequately sanitize an attacker-controlled filename before constructing its destination path. A local attacker-controlled app can therefore supply path components that escape the intended shared attachment directory and overwrite or corrupt files in the FairEmail private data directory, including account or message databases. Exploitation requires app lock using PIN or biometric authentication and user interaction to unlock FairEmail. This issue is fixed in version 1.2325.

Etkilenen sürümler1 yazılım

Kaynaklar5 kaynak

• CVE.org kaydı
• NVD kaydı
• github.com/…rEmail/security/advisories/GHSA-w92m-2v27-mvg9 Diğer
• github.com/…ommit/538523dded741f7a8a76052de9a69806d357c0f4 Diğer
• github.com/M66B/FairEmail/releases/tag/1.2325 Diğer

Kayıt geçmişi

1. 6 Kas 2026 01:45Yayımlandı

İlgili açıklar

• 6,5 CVE-2026-102943Dagu MCP DAG specification read bypasses path containment and workspace isolation
• 7,1 CVE-2026-87008Code Graph RAG: Symlink ile kök dizin dışına çıkılarak dosya okuma ve üzerine yazma
• 7,5 CVE-2026-77604Code Graph RAG: MCP paginated read_file path traversal / arbitrary file read
• 7,2 CVE-2026-63213SuiteCRM: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in SuiteCRM
• 8,3 CVE-2026-107129Joomla Extension - balbooa.com - Unauthenticated arbitrary file deletion via path traversal in Gridbox < 2.20.5.0
• 7,8 CVE-2026-119083GluonTS arbitrary file write during archive extraction