CVE-2026-58128
Alan: Health Insurance for Android (com.alanmobile) 1.450.0 contains a path traversal vulnerability…
- Risk score
- 42/100
- CVSS
- 6.2 v3.1
- Exploit chance (30 days)
- 0.3%
- Published
- 4 Nov 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Alan: Health Insurance for Android (com.alanmobile) 1.450.0 contains a path traversal vulnerability that allows a co-resident malicious application to write attacker-controlled files outside the intended directory via the exported ShareReceiverActivity, which uses an unsanitized _display_name value from a shared conte…
- Affected
- See advisory
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 6.2 medium
References
Original description
Alan: Health Insurance for Android (com.alanmobile) 1.450.0 contains a path traversal vulnerability that allows a co-resident malicious application to write attacker-controlled files outside the intended directory via the exported ShareReceiverActivity, which uses an unsanitized _display_name value from a shared content URI to construct the destination file path. Attackers can send a crafted ACTION_SEND intent with a _display_name containing directory traversal sequences to overwrite sensitive files within the app's sandbox such as databases, shared_prefs, and WebView data, enabling state tampering or code execution in the app's context without authentication or user interaction.
Last activity 4 Nov 2026. Patch Forecast updates every hour.