CVE-2026-18648 Overview
CVE-2026-18648 is a path traversal vulnerability [CWE-22] in the Blix Blue Mail Calendar App version 2.2.305 for Android. The flaw resides in the FileDirectory.getDataColumn and FileDirectory.getFileFromUri functions within the react-native-receive-sharing-intent component. An attacker with local access can manipulate the _display_name argument to traverse outside the intended directory. Exploit code has been published, but the vendor did not respond to disclosure attempts.
Critical Impact
Local attackers can leverage the _display_name parameter to read or write files outside the intended sandbox scope, exposing application data.
Affected Products
- Blix Blue Mail Calendar App version 2.2.305 (Android)
- Applications embedding the react-native-receive-sharing-intent component with vulnerable FileDirectory handling
- Downstream React Native builds relying on the same file URI resolution logic
Discovery Timeline
- 2026-08-03 - CVE-2026-18648 published to NVD
- 2026-08-05 - Last updated in NVD database
Technical Details for CVE-2026-18648
Vulnerability Analysis
The vulnerability exists in the file resolution path of the react-native-receive-sharing-intent library used by the Blix Blue Mail Calendar App. When the app receives a shared file intent, the FileDirectory.getDataColumn and FileDirectory.getFileFromUri functions read the _display_name column from the content resolver and use it to construct a local file path. The functions do not sanitize directory separators or parent references embedded in that value.
An attacker who supplies a content URI with a crafted _display_name such as ../../databases/target.db can steer the write or read operation to arbitrary locations within the app's private storage. The impact covers limited confidentiality, integrity, and availability of application data. Exploitation requires local access and low privileges, and no user interaction is needed beyond delivering the malicious shared content.
Root Cause
The root cause is missing input validation on the _display_name field returned by the Android content resolver. The library treats attacker-controllable metadata as a trusted filename component and concatenates it into a filesystem path without canonicalization or traversal checks, matching the classic [CWE-22] pattern.
Attack Vector
A malicious app installed on the same device can create a ContentProvider that returns a traversal payload in the _display_name column. When the victim shares content into Blue Mail, the vulnerable functions resolve the crafted name and write the received file outside the intended cache directory. This allows overwriting or planting files in sensitive locations inside the app sandbox.
The vulnerability manifests in how the FileDirectory helper builds destination paths from untrusted content metadata. See the linked references for the public proof-of-concept details.
Detection Methods for CVE-2026-18648
Indicators of Compromise
- Files written under Blue Mail's private directories with names containing .. sequences or unexpected subpaths
- Presence of the proof-of-concept repository artifacts on developer or test devices
- Unexpected ContentProvider invocations targeting me.bluemail.mail from newly installed third-party apps
Detection Strategies
- Inspect application logs and MDM telemetry for share-intent activity involving Blue Mail followed by file creation outside cache/ or files/received/
- Perform static analysis of installed APKs to identify use of the vulnerable react-native-receive-sharing-intent version
- Monitor for co-installed apps that expose ContentProvider endpoints returning suspicious _display_name values
Monitoring Recommendations
- Enable mobile threat defense telemetry to flag path traversal patterns in shared file metadata
- Track installations of Blue Mail Calendar App version 2.2.305 across the managed device fleet
- Alert on new sideloaded apps that declare SEND or SEND_MULTIPLE intent filters targeting Blue Mail
How to Mitigate CVE-2026-18648
Immediate Actions Required
- Identify managed devices running Blue Mail Calendar App version 2.2.305 and restrict file-sharing intents to trusted apps
- Discourage sideloading of unknown apps that could act as malicious ContentProvider sources
- Review the VulDB entry for CVE-2026-18648 and the public proof-of-concept to validate exposure
Patch Information
No vendor patch is available. The advisory states that Blix was contacted early about this disclosure but did not respond. Track updates on the Google Play listing and the VulDB vulnerability record #385567 for future fixes.
Workarounds
- Remove or replace Blue Mail Calendar App 2.2.305 on managed devices until a fixed version is released
- Apply mobile device management policies that block installation of unverified third-party apps capable of exporting content providers
- For developers of apps that embed react-native-receive-sharing-intent, validate the _display_name value by rejecting entries containing path separators or parent-directory references before writing to disk
# Example MDM query to list impacted devices
adb shell pm list packages --show-versioncode | grep me.bluemail.mail
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
