The vulnerability resides in the Android implementation of the receive_sharing_intent package, where the FileDirectory.getDataColumn method fails to properly validate the _display_name field supplied by an external ContentProvider. An attacker can craft a display name such as ../databases/proof.txt and supply a controlled content stream, forcing the receiving application to write the supplied data to an arbitrary location outside its intended cache directory. The result is that sensitive or system files inside the receiving app's private sandbox can be created or overwritten without user interaction, potentially leading to persistence of malicious code or data tampering.

The affected product is the receive_sharing_intent package, developed by KasemJaffer. Versions 1.4.1 through 1.9.0 are affected. Any application that incorporates these versions is at risk, as the flaw lies in the package's internal handling of incoming shared content.

The vulnerability has a CVSS score of 6.9, indicating a moderate severity. The EPSS score is not available, so the current exploitation probability cannot be quantified, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is a local co‑resident malicious application that controls an untrusted ContentProvider. The attempt would require the attacker to supply a crafted _display_name and a controlled content stream to the vulnerable application, but no direct user interaction or elevated privileges are needed beyond co‑resident execution. The impact is limited to the receiving application’s private sandbox, which is isolated from other apps, but within that sandbox the attacker can overwrite arbitrary files.