CVE-2026-68509

Full vulnerability record from the local CVENow database.

Description

FairEmail is a fully featured, open source, privacy-friendly email app for Android. Prior to 1.2325, shared attachment handling does not adequately sanitize an attacker-controlled filename before constructing its destination path. A local attacker-controlled app can therefore supply path components that escape the intended shared attachment directory and overwrite or corrupt files in the FairEmail private data directory, including account or message databases. Exploitation requires app lock using PIN or biometric authentication and user interaction to unlock FairEmail. This issue is fixed in version 1.2325.

Severity

MEDIUM

CVSS score

6.3 (v3.1)

Vulnerability status

Received

Source identifier

[email protected]

Published

2026-11-05 23:16:56.587000

Last modified

2026-11-05 23:16:56.587000

View original CVE JSON

{
  "id": "CVE-2026-68509",
  "sourceIdentifier": "[email protected]",
  "published": "2026-11-05T23:16:56.587",
  "lastModified": "2026-11-05T23:16:56.587",
  "vulnStatus": "Received",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "FairEmail is a fully featured, open source, privacy-friendly email app for Android. Prior to 1.2325, shared attachment handling does not adequately sanitize an attacker-controlled filename before constructing its destination path. A local attacker-controlled app can therefore supply path components that escape the intended shared attachment directory and overwrite or corrupt files in the FairEmail private data directory, including account or message databases. Exploitation requires app lock using PIN or biometric authentication and user interaction to unlock FairEmail. This issue is fixed in version 1.2325."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "M66B",
          "product": "FairEmail",
          "versions": [
            {
              "version": "< 1.2325",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H",
          "baseScore": 6.3,
          "baseSeverity": "MEDIUM",
          "attackVector": "LOCAL",
          "attackComplexity": "HIGH",
          "privilegesRequired": "NONE",
          "userInteraction": "REQUIRED",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 1.0,
        "impactScore": 5.2
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/M66B/FairEmail/commit/538523dded741f7a8a76052de9a69806d357c0f4",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/M66B/FairEmail/releases/tag/1.2325",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/M66B/FairEmail/security/advisories/GHSA-w92m-2v27-mvg9",
      "source": "[email protected]"
    }
  ]
}