CVE-2026-78196: expo-share-intent Path Traversal Vulnerability

CVE-2026-78196 Overview

CVE-2026-78196 is a path traversal vulnerability [CWE-22] in the achorein/expo-share-intent library through version 8.0.0. The flaw resides in the getDataColumn function within ExpoShareIntentModule.kt, part of the Android File Copy Routine. An attacker who controls the _display_name value of a shared file can manipulate the destination path when the library copies content into the app cache directory. Exploitation requires local access on the Android device. Version 8.0.1 mitigates the issue via commit c6900b1ed06fcc3ca4b09651348974ac5b95e4e6.

Critical Impact
A malicious application or shared content provider can supply a crafted _display_name containing traversal sequences, causing the affected Android app to write files outside its cache directory and potentially overwrite sensitive application files.

Affected Products

achorein/expo-share-intent versions up to and including 8.0.0
Android component ExpoShareIntentModule.kt (function getDataColumn)
Expo applications embedding the vulnerable share-intent module

Discovery Timeline

2026-08-24 - CVE-2026-78196 published to the National Vulnerability Database (NVD)
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-78196

Vulnerability Analysis

The expo-share-intent module enables Android apps built with Expo to receive files shared from other applications. When a share intent references a content URI, the module queries the content resolver for the _display_name column and passes the returned string directly into a File(context.cacheDir, fileName) constructor. If the caller-controlled name contains directory separators or parent-directory tokens such as ../, the resolved path can escape the intended cache directory.

Because the destination file object is subsequently used as the write target for the copy operation, an attacker can direct the write outside the sandboxed cache location. Depending on Android scoped-storage constraints and app permissions, the primitive can be used to overwrite files within the app's private storage, corrupting state or planting attacker-controlled data.

Root Cause

The root cause is missing input sanitization on the value returned from the content provider's _display_name column. The affected code trusts the file name to be a leaf identifier and does not validate that the resolved canonical path remains inside context.cacheDir. This is a classic path traversal weakness catalogued as [CWE-22].

Attack Vector

Exploitation is local. A malicious app or content provider on the same device crafts a share intent whose _display_name includes traversal sequences. When the victim triggers the share flow into an app using vulnerable expo-share-intent, the copy routine resolves the malicious name and writes the shared payload to an attacker-chosen path inside the app sandbox.

text

                     val columnIndex = cursor.getColumnIndexOrThrow(column)
                     val fileName = cursor.getString(columnIndex)
                     Log.i("FileDirectory", "File name: $fileName")
-                    targetFile = File(context.cacheDir, fileName)
-                }
+                    val safeName = fileName?.let { File(it).name }.orEmpty()
+                    if (safeName.isNotEmpty()) {
+                        val candidate = File(context.cacheDir, safeName)
+                        val cacheRoot = context.cacheDir.canonicalPath + File.separator
+                        if (candidate.canonicalPath.startsWith(cacheRoot)) {
+                            targetFile = candidate
+                        }
+                    }                }
             } finally {
                 cursor?.close()
             }

Source: GitHub Commit c6900b1e Update

The patch strips directory components from the supplied name using File(it).name, then verifies that the candidate's canonical path is rooted within context.cacheDir before assigning it as the target file.

Detection Methods for CVE-2026-78196

Indicators of Compromise

Files present in the app's private data directory with names or paths that do not match legitimate cache artifacts.
Log entries from the FileDirectory tag showing _display_name values containing ../ or absolute path separators.
Unexpected modification timestamps on application configuration or database files following a share-intent operation.

Detection Strategies

Perform static analysis (SAST) on Android/Kotlin codebases for uses of context.cacheDir combined with unvalidated content provider column values.
Audit dependency manifests (package.json, yarn.lock) for expo-share-intent versions at or below 8.0.0.
Instrument test builds to log resolved targetFile.canonicalPath and alert when it falls outside the cache directory.

Monitoring Recommendations

Monitor Google Play and internal app-security scanners for dependency advisories referencing expo-share-intent and [CWE-22].
Track file-system writes by Expo-based apps during share operations in QA environments to catch anomalous target paths.
Review crash and integrity reports for unexpected overwrites of shared preferences, SQLite databases, or configuration files.

How to Mitigate CVE-2026-78196

Immediate Actions Required

Upgrade expo-share-intent to version 8.0.1 or later across all Android projects.
Rebuild and redistribute affected mobile applications through Play Store or enterprise MDM channels.
Inventory Expo-based apps and confirm the transitive dependency version resolved at build time.

Patch Information

The fix is delivered in commit c6900b1ed06fcc3ca4b09651348974ac5b95e4e6 and released as version 8.0.1. See the GitHub Release v8.0.1 Notes and the GitHub Pull Request #221 Discussion for details. The patch sanitizes _display_name by extracting only the leaf file name and validates that the canonical destination path remains inside context.cacheDir.

Workarounds

If upgrading is not immediately feasible, fork the module and apply the sanitization logic from the upstream commit locally.
Wrap calls into the share-intent module with a custom handler that validates any exposed file name against a strict allow-list before write operations.
Restrict which external apps can invoke share intents to the affected application via manifest intent-filter scoping where practical.

bash

# Update the dependency in an Expo/React Native project
npm install expo-share-intent@^8.0.1
# or
yarn add expo-share-intent@^8.0.1

# Verify the resolved version
npm ls expo-share-intent