Vulnerability · Published Aug 3, 2026 · Assigned by VulDB

CVE-2026-18648Blix Email Blue Mail Calendar App react-native-receive-sharing-intent FileDirectory.getFileFromUri path traversal

Medium 5.3

In plain English

A medium-severity path traversal in Email Blue Mail Calendar App from Blix. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 11% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.2%top 88.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability was detected in Blix Email Blue Mail Calendar App 2.2.305. Impacted is the function FileDirectory.getDataColumn/FileDirectory.getFileFromUri of the component react-native-receive-sharing-intent. The manipulation of the argument _display_name results in path traversal. The attack is only possible with local access. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products (as reported)

Vendor	Product	Versions
Blix	Email Blue Mail Calendar App	2.2.305

Weakness: CWE-22 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

References

VDB-385567 | Blix Email Blue Mail Calendar App react-native-receive-sharing-intent FileDirectory.getFileFromUri path traversal vdb-entry, technical-description
VDB-385567 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
CVE-2026-18648 | CVE Analysis and Report third-party-advisory
Submit #855049 | BlueMail https://play.google.com/store/apps/details?id=me.bluemail.mail 2.2.305 (versionCode 43203). Path Traversal third-party-advisory
https://github.com/actuator/me.bluemail.mail exploit