The library processes a _display_name field received via a ContentProvider and writes the payload to a cache directory. Because dot‑dot components are not normalised or removed, the component allows a path traversal that enables a malicious co‑resident application to write files outside the intended cache folder. When an attacker crafts an ACTION_SEND intent with a specially‑crafted _display_name and targets the exported share‑receiver activity, arbitrary files in the consuming app’s private data directory—including databases, shared preferences and cached configuration—can be overwritten with attacker‑controlled content. The result is data tampering that can impact application correctness and user data remote code execution is achieved solely through this flaw; the impact is limited to file overwrite.

The issue exists in the ajith‑ab react‑native‑receive‑sharing‑intent component used within React Native mobile applications. Any app that integrates this component and exposes the share‑receiver activity remains vulnerable. The advisory does not specify a version range, implying that all builds containing the unpatched code are at risk unless the component is updated or the activity is disabled.

The CVSS score of 7 indicates a high severity, while the EPSS score of < 1% reflects a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires a malicious application present on the same device to dispatch the crafted ACTION_SEND intent to the exported share‑receiver activity, making the attack vector local. Based on the advisory, it is inferred that disabling the exported activity or restricting its intent filters can prevent the exploit, and that sanitising the incoming _display_name path components removes the traversal path.