CVE-2026-30279: Squareapps My Location RCE Vulnerability

CVE-2026-30279 Overview

CVE-2026-30279 is an arbitrary file overwrite vulnerability in Squareapps LLC My Location Travel Timeline version 11.80 for Android. The flaw resides in the application's file import process, which fails to validate destination paths when handling imported content. Attackers with local access can overwrite critical internal application files. Successful exploitation leads to arbitrary code execution within the app context or exposure of sensitive user data stored by the application. The vulnerability is tracked under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory).

Critical Impact
A local attacker can overwrite internal files of the My Location Travel Timeline Android app, enabling arbitrary code execution and exposure of stored location and travel data.

Affected Products

Squareapps LLC My Location Travel Timeline v11.80 (Android)
Component: squareapps:my_location
CPE: cpe:2.3:a:squareapps:my_location:11.80:*:*:*:*:android:*:*

Discovery Timeline

2026-03-31 - CVE-2026-30279 published to NVD
2026-04-03 - Last updated in NVD database

Technical Details for CVE-2026-30279

Vulnerability Analysis

The vulnerability is a path traversal flaw classified under [CWE-22]. My Location Travel Timeline accepts user-supplied files through its import functionality. The import handler does not properly sanitize file path components contained in the imported archive or input stream.

An attacker who controls the imported file can craft entries with relative path sequences such as ../ to escape the intended import directory. The application then writes attacker-controlled content to arbitrary locations within its sandbox, including internal configuration files, databases, or executable code paths used by the app at runtime.

Because the write occurs with the privileges of the app process, attackers can replace files that the application later loads or executes. This converts a file write primitive into arbitrary code execution within the application's security context, exposing stored location history, travel timelines, and any cached credentials.

Root Cause

The root cause is missing canonicalization and validation of file paths during the import process. The application trusts path metadata supplied by the imported file and writes data to the resolved destination without verifying that the final path remains within the intended import directory.

Attack Vector

Exploitation requires local access to deliver a malicious import file to the target device. An attacker can stage a crafted file via a shared storage location, a malicious app, an SD card, or social engineering. The victim then imports the file through the application's normal import workflow. No authentication or user privileges beyond standard app interaction are required to trigger the flaw.

No public proof-of-concept or exploit code is currently available for CVE-2026-30279. See the GitHub Issue #28 Discussion and the SecSys Fudan University Portal for additional technical context.

Detection Methods for CVE-2026-30279

Indicators of Compromise

Unexpected modifications to files inside the My Location Travel Timeline application's private data directory on Android (/data/data/<package>/).
Presence of import archives or files containing path traversal sequences such as ../ in entry names.
Unexpected child processes or library loads originating from the My Location Travel Timeline application.

Detection Strategies

Inspect Android application sandboxes for files written outside expected import subdirectories after an import operation.
Hunt for filenames containing .., absolute path prefixes, or non-ASCII separators within imported archives staged in shared storage.
Monitor mobile telemetry for anomalous file write patterns by the squareapps:my_location package immediately following import events.

Monitoring Recommendations

Enable mobile threat defense logging for file system events and integrity checks on installed applications.
Alert on imports of files from untrusted sources such as messaging apps, email attachments, or external storage.
Track application version inventory to identify devices still running version 11.80 of My Location Travel Timeline.

How to Mitigate CVE-2026-30279

Immediate Actions Required

Stop importing files into My Location Travel Timeline from untrusted sources until a patched version is installed.
Inventory mobile devices running version 11.80 and prioritize remediation on devices that handle sensitive location data.
Restrict the application's access to shared and external storage where feasible through Android permission controls.

Patch Information

No vendor advisory or patched version has been published in the references available at the time of writing. Monitor the vendor's site, My.com Security Overview, and the GitHub Issue #28 Discussion for fix announcements. Upgrade to a version newer than 11.80 as soon as the vendor releases one that addresses [CWE-22] in the file import handler.

Workarounds

Disable or avoid the file import feature within My Location Travel Timeline until a patched release is available.
Remove the application from devices that do not require it, particularly in enterprise environments managing sensitive travel data.
Use mobile device management (MDM) policies to block installation of version 11.80 and to enforce up-to-date application baselines.

bash

# Example MDM policy enforcement (conceptual)
# Block installation of vulnerable version via Android Enterprise managed configuration
adb shell pm list packages | grep squareapps
adb shell pm uninstall --user 0 com.squareapps.mylocation