react‑native‑receive‑sharing‑intent includes a path‑traversal vulnerability (CWE‑22) that allows a malicious application installed on the same device to write files outside the intended cache directory by providing a crafted _display_name containing dot‑dot sequences through a ContentProvider. When a ACTION_SEND intent is sent to the consumer app’s exported share‑receiver activity, the component normalises the supplied display name and writes the content to the resulting path. Because the normalisation does not resolve traversal components, attackers can target any file inside the consumer app’s private data directory, overwriting databases, shared preferences, or configuration files with arbitrary content.

Any React Native mobile application that includes the ajith‑ab react‑native‑receive‑sharing‑intent module and exposes an exported share‑receiver activity is vulnerable. The module has not yet released a patched version that sanitises the _display_name input, so all builds containing the unmodified code remain at risk until the module is updated or the export is disabled.

The CVSS score of 7 categorises this flaw as high severity, while the EPSS score of < 1% suggests a low probability of real‑world exploitation. The vulnerability does not provide remote code execution; exploitation requires a malicious app on the same device to dispatch a crafted ACTION_SEND intent to the exported activity, which is therefore a local attack vector. Until a patch or mitigation is applied, the flaw can lead to serious data tampering and loss of confidentiality and integrity, particularly for sensitive app data such as user credentials or cached state.