Vulnerability · Published Nov 4, 2026 · Assigned by VulnCheck

CVE-2026-58128Alan: Health Insurance for Android 1.450.0 Path Traversal via ShareReceiverActivity

Medium 6.2

In plain English

A medium-severity path traversal in Alan: Health Insurance from Alan Health. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities).

Severity (CVSS 3.1)6.2Medium

Exploit odds (30 days)0.3%top 76.3% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

Alan: Health Insurance for Android (com.alanmobile) 1.450.0 contains a path traversal vulnerability that allows a co-resident malicious application to write attacker-controlled files outside the intended directory via the exported ShareReceiverActivity, which uses an unsanitized _display_name value from a shared content URI to construct the destination file path. Attackers can send a crafted ACTION_SEND intent with a _display_name containing directory traversal sequences to overwrite sensitive files within the app's sandbox such as databases, shared_prefs, and WebView data, enabling state tampering or code execution in the app's context without authentication or user interaction.

Affected products (as reported)

Vendor	Product	Versions
Alan Health	Alan: Health Insurance	1.450.0

Weakness: CWE-22 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

References

Researcher Disclosure technical-description, exploit
Google Play product
VulnCheck Advisory: Alan: Health Insurance for Android 1.450.0 Path Traversal via ShareReceiverActivity third-party-advisory