CVE-2026-58460: react-native-receive-sharing-intent Path Traversal Vulnerability – HIGH Severity

Technical summary

CVE-2026-58460 is a local path traversal vulnerability (CWE-22) in react-native-receive-sharing-intent that arises from insufficient validation of the _display_name parameter passed through a malicious ContentProvider. When a consuming app's exported share-receiver activity processes an explicit ACTION_SEND intent, the library fails to sanitize dot-dot path components in the display name, allowing directory traversal. This permits a co-resident application to write arbitrary content to the consuming app's private data directory (/data/data/<package>/), potentially overwriting sensitive files such as SQLite databases, shared preferences XML files, and application configuration caches. The vulnerability requires no user interaction and no special permissions beyond being installed on the device.

Business impact

Organizations whose applications depend on react-native-receive-sharing-intent face a risk of data integrity compromise and potential application malfunction. An attacker could inject malicious configuration, corrupt critical application state, or poison cached credentials, leading to app crashes, incorrect business logic execution, or unauthorized access to sensitive user data. For consumer-facing apps, this could result in user data loss, privacy violations, and reputational damage. Enterprise deployments that rely on react-native-receive-sharing-intent for document or file handling workflows are at particular risk if the library is used in sensitive contexts.

Affected systems

Any Android application that directly or transitively depends on react-native-receive-sharing-intent and exposes a share-receiver activity is vulnerable. This includes mobile apps built with React Native that implement file sharing functionality. The vulnerability is platform-specific to Android and requires the malicious app to be installed on the same device as the target app. Affected versions of the library have not been explicitly enumerated in the source data; developers should consult the react-native-receive-sharing-intent repository and vendor advisories to determine which library versions contain the vulnerable code.

Exploitability

Exploitability is straightforward for an attacker with local device access (i.e., ability to install a malicious app on the target device). The attack requires no user interaction, no special permissions, and no elevated privileges—only that the malicious app coexist with the vulnerable consuming app. This is a realistic threat in contexts where users may sideload applications from untrusted sources or where a device is compromised by another threat actor. The CVSS score of 7.7 (HIGH) reflects the high impact on integrity and availability, combined with low attack complexity and local-only scope.

Remediation

Developers must update react-native-receive-sharing-intent to a patched version that properly sanitizes the _display_name parameter and prevents path traversal. At a minimum, implement strict validation to reject any file names containing path traversal sequences ("../", "..\\", or other dot-dot variants), restrict file write operations to a whitelist of safe directories, and canonicalize all file paths before use. Consuming applications should review their share-receiver activity implementation to ensure they are not performing additional file operations on untrusted input.

Patch guidance

Check the react-native-receive-sharing-intent GitHub repository and release notes for a patched version that addresses CWE-22 path traversal. Verify the patch includes proper input validation on the _display_name parameter. Update your project's package.json dependency and run your dependency manager (npm, yarn, or pnpm) to pull the latest secure version. Test your app's file sharing functionality thoroughly in a staging environment before releasing to production. If the library maintainers have not yet released a fix, consider temporarily disabling file sharing functionality or implementing a workaround that validates and sanitizes all incoming file names before processing.

Detection guidance

Monitor for attempts by untrusted applications to send ACTION_SEND intents with suspicious _display_name values containing "../" or similar path traversal patterns. Implement logging in your share-receiver activity to record the source package, file name, and destination path of all share intents. Look for unexpected file modifications in your app's private data directory (/data/data/<package>/) outside normal application behavior, particularly in database or shared preferences files. On-device threat detection tools and Mobile Threat Defense (MTD) solutions can flag suspicious inter-app communication patterns and unauthorized file access attempts.

Why prioritize this

This vulnerability merits urgent attention due to its HIGH CVSS score (7.7), direct impact on data integrity, and the ease with which a local attacker can exploit it without user interaction. Any application that shares user data, credentials, or sensitive configuration through react-native-receive-sharing-intent is at risk of having that data corrupted or exfiltrated indirectly through configuration poisoning. The local-only attack surface does not diminish the severity, as sideloading and device compromise are real-world threats.

Risk score, explained

The CVSS 3.1 score of 7.7 reflects: (1) Attack Vector: Local—requires the malicious app to be on the same device; (2) Attack Complexity: Low—no special conditions or user interaction needed; (3) Privileges Required: None—the attacker's app needs only standard installation; (4) User Interaction: None—the exploit occurs automatically via intent handling; (5) Scope: Unchanged—impact is confined to the consuming app; (6) Confidentiality: None—files are overwritten, not read; (7) Integrity: High—arbitrary file overwrite in the app's private directory; (8) Availability: High—corrupted databases or configuration can crash or disable the app. The HIGH severity is justified by the combination of trivial exploitability and severe impact on data integrity and app availability.

Frequently asked questions