The vulnerability is a path traversal in TickTick for Android’s exported ShareReceiveActivity. It allows a malicious local application to compose a content:// URI with a traversal filename in an ACTION_SEND intent. A ContentProvider can supply a _display_name that contains traversal sequences, which the application passes unsanitized to FileManager.getDisplayNameFromUri and AttachmentFileHelper.copyFileDirectly, resulting in automatic file writes outside the intended attachment directory. The attacker can thus place arbitrary files at locations chosen with TickTick’s application privileges, potentially overwriting critical files or installing malicious payloads.

The affected product is TickTick for Android, version 8.2.2.0, released by TickTick Limited.

The CVSS score of 6.9 indicates a moderate severity. The EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog, implying no known exploitation at this time. Exploitation requires a malicious local application and user interaction: the attacker must supply a crafted ACTION_SEND intent while the victim uses TickTick to receive a file. Attackers cannot act remotely on an arbitrary device; the threat is limited to local device compromise or targeted infection.