Vulnerability · Published Nov 5, 2026 · Assigned by GitHub_M
CVE-2026-68509FairEmail: Path traversal in shared attachment handling can write files outside the intended shared directory
Medium 6.3
In plain English
A medium-severity path traversal in FairEmail from M66B. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 4% of all known vulnerabilities).
Official description
FairEmail is a fully featured, open source, privacy-friendly email app for Android. Prior to 1.2325, shared attachment handling does not adequately sanitize an attacker-controlled filename before constructing its destination path. A local attacker-controlled app can therefore supply path components that escape the intended shared attachment directory and overwrite or corrupt files in the FairEmail private data directory, including account or message databases. Exploitation requires app lock using PIN or biometric authentication and user interaction to unlock FairEmail. This issue is fixed in version 1.2325.
Affected products (as reported)
Weakness: CWE-22 · Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H
References
- https://github.com/M66B/FairEmail/security/advisories/GHSA-w92m-2v27-mvg9 x_refsource_CONFIRM
- https://github.com/M66B/FairEmail/commit/538523dded741f7a8a76052de9a69806d357c0f4 x_refsource_MISC
- https://github.com/M66B/FairEmail/releases/tag/1.2325 x_refsource_MISC