CVE-2026-68509
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
In FairEmail prior to 1.2325, shared attachment handling does not adequately sanitize an attacker-controlled filename before constructing its destination path. A local attacker-controlled app can supply path components that escape the shared attachment directory and overwrite files in the FairEmail private data directory.
Risk Assessment
Account or message databases in the app's private data directory can be overwritten or corrupted, potentially causing data loss or further compromise.
Recommendation
Update FairEmail to version 1.2325 and keep app lock (PIN or biometric) enabled.
Other vulnerabilities in FairEmail
Original NVD description (English source)
FairEmail is a fully featured, open source, privacy-friendly email app for Android. Prior to 1.2325, shared attachment handling does not adequately sanitize an attacker-controlled filename before constructing its destination path. A local attacker-controlled app can therefore supply path components that escape the intended shared attachment directory and overwrite or corrupt files in the FairEmail private data directory, including account or message databases. Exploitation requires app lock using PIN or biometric authentication and user interaction to unlock FairEmail. This issue is fixed in version 1.2325.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS