{"affected":[{"defaultStatus":"unaffected","product":"Alan: Health Insurance","source":"CNA: VulnCheck","vendor":"Alan Health","versions":[{"status":"affected","version":"1.450.0"}]}],"cveId":"CVE-2026-58128","cwes":["CWE-22"],"description":"Alan: Health Insurance for Android (com.alanmobile) 1.450.0 contains a path traversal vulnerability that allows a co-resident malicious application to write attacker-controlled files outside the intended directory via the exported ShareReceiverActivity, which uses an unsanitized _display_name value from a shared content URI to construct the destination file path. Attackers can send a crafted ACTION_SEND intent with a _display_name containing directory traversal sequences to overwrite sensitive files within the app's sandbox such as databases, shared_prefs, and WebView data, enabling state tampering or code execution in the app's context without authentication or user interaction.","epss":null,"exploits":[{"kind":"exploit","source":"CNA: VulnCheck","url":"https://github.com/actuator/com.alanmobile"}],"kev":null,"metrics":[{"score":6.9,"severity":"medium","source":"CNA: VulnCheck","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","version":"4.0"},{"score":6.2,"severity":"medium","source":"CNA: VulnCheck","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","version":"3.1"}],"modifiedAt":1793827908175,"publishedAt":1793827908175,"references":[{"source":"CNA: VulnCheck","tags":["technical-description","exploit"],"url":"https://github.com/actuator/com.alanmobile"},{"source":"CNA: VulnCheck","tags":["product"],"url":"https://play.google.com/store/apps/details?id=com.alanmobile"},{"source":"CNA: VulnCheck","tags":["third-party-advisory"],"url":"https://www.vulncheck.com/advisories/alan-health-insurance-for-android-path-traversal-via-sharereceiveractivity"}],"remediation":[],"revision":"448e83c135538714e46aad015e217e2b98580fd28e3b625c4734a0465ddb6d5a","sources":[{"modifiedAt":1793827908175,"name":"CNA: VulnCheck","retrievedAt":1793830390480,"url":"https://www.cve.org/CVERecord?id=CVE-2026-58128"}],"ssvc":null,"status":"published","title":"Alan: Health Insurance for Android 1.450.0 Path Traversal via ShareReceiverActivity","updatedAt":1793830390480}