# CVE-2026-68509: FairEmail: Path traversal in shared attachment handling can write files outside the intended shared directory

Status: published. Published: 2026-11-05. Updated: 2026-11-05.

FairEmail is a fully featured, open source, privacy-friendly email app for Android. Prior to 1.2325, shared attachment handling does not adequately sanitize an attacker-controlled filename before constructing its destination path. A local attacker-controlled app can therefore supply path components that escape the intended shared attachment directory and overwrite or corrupt files in the FairEmail private data directory, including account or message databases. Exploitation requires app lock using PIN or biometric authentication and user interaction to unlock FairEmail. This issue is fixed in version 1.2325.

## Remediation

No remediation reported in collected sources

## Affected products and versions

- M66B / FairEmail: < 1.2325 (affected). Source: CNA: GitHub_M

## Severity and prioritization

- CVSS 3.1: 6.3 (medium); CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H; source: CNA: GitHub_M

- CISA KEV: No listing in collected sources

- EPSS: Not available

- SSVC: Not available

- Weaknesses: CWE-22

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://github.com/M66B/FairEmail/security/advisories/GHSA-w92m-2v27-mvg9 (CNA: GitHub_M; x_refsource_CONFIRM)

- https://github.com/M66B/FairEmail/commit/538523dded741f7a8a76052de9a69806d357c0f4 (CNA: GitHub_M; x_refsource_MISC)

- https://github.com/M66B/FairEmail/releases/tag/1.2325 (CNA: GitHub_M; x_refsource_MISC)

## Provenance

- CNA: GitHub_M: https://www.cve.org/CVERecord?id=CVE-2026-68509; retrieved 2026-11-05; source updated 2026-11-05

Revision: f17648f184d484615680ae522a485447d6961cbabc5f06190ec1d33009c16bb1

Canonical: https://y2.dev/cve/CVE-2026-68509

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.