Read the docs
TI-2026-85708 Aliases CVE-2026-68509

Path traversal in FairEmail attachment handling overwrites app data

Priority LOW 27CWE-22Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
None · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

FairEmail by M66B before 1.2325 does not sanitize attacker-controlled filenames in shared attachment handling before it builds the destination path. A path traversal (CWE-22) lets path components escape the shared attachment directory. A local app controlled by an attacker can overwrite or corrupt files in the FairEmail private data directory, including account or message databases, when a user unlocks FairEmail with app lock and interacts with it.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

FairEmail is a fully featured, open source, privacy-friendly email app for Android. Prior to 1.2325, shared attachment handling does not adequately sanitize an attacker-controlled filename before constructing its destination path. A local attacker-controlled app can therefore supply path components that escape the intended shared attachment directory and overwrite or corrupt files in the FairEmail private data directory, including account or message databases. Exploitation requires app lock using PIN or biometric authentication and user interaction to unlock FairEmail. This issue is fixed in version 1.2325.

Why it matters now

EPSS 0.00143 3rd percentileScored 2026-11-07
Fix Fixed FairEmail (M66B): 1.2325

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
M66BFairEmailbefore 1.23251.2325Patch availableCNA
  • FairEmail VendorM66B Affected before 1.2325 Fixed in 1.2325 Patch available CNA

Remediation

Upgrade FairEmail to version 1.2325, which fixes the issue.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA FairEmail (M66B) Fixed in 1.2325

Timeline

  1. 2026-11-05 Threatist record created from CVE-2026-68509
  2. 2026-11-07 Priority changed: MEDIUM → LOW

References

Other 3

  • TI-2026-39367 FairEmail: Cross-site scripting (XSS) in AMP message rendering (ActivityAMP) CVSS 3.1MEDIUM 6.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences