CVE-2026-68509

    Dashboard / Vulnerabilities / CVE-2026-68509

    CVE-2026-68509

    Published: 5 Nov 2026Last Modified: 7 Nov 2026

    Summary: FairEmail: Path traversal in shared attachment handling can write files outside the intended shared directory

    Details: FairEmail is a fully featured, open source, privacy-friendly email app for Android. Prior to 1.2325, shared attachment handling does not adequately sanitize an attacker-controlled filename before constructing its destination path. A local attacker-controlled app can therefore supply path components that escape the intended shared attachment directory and overwrite or corrupt files in the FairEmail private data directory, including account or message databases. Exploitation requires app lock using PIN or biometric authentication and user interaction to unlock FairEmail. This issue is fixed in version 1.2325.

    References: https://github.com/M66B/FairEmail/releases/tag/1.2325, https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68509.json, https://github.com/M66B/FairEmail/security/advisories/GHSA-w92m-2v27-mvg9, https://nvd.nist.gov/vuln/detail/CVE-2026-68509, https://github.com/M66B/FairEmail/commit/538523dded741f7a8a76052de9a69806d357c0f4

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -b3ce6f4782eed614995996a064d7c92621279889

    Affected versions

    1.2324

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-68509 | CVE-DB