FairEmail does not properly sanitize the filename of a shared attachment before building its destination path. A local attacker‑controlled app can supply path components that escape the intended shared attachment directory, enabling overwrite or corruption of files in FairEmail’s private data directory. This includes account and message databases, which could result in data loss or unauthorized data access. The flaw is a classic directory traversal problem (CWE‑22).

The affected product is FairEmail by M66B, versions prior to 1.2325. The vulnerability is triggered in any installation where shared attachments are used and the application is unlocked by a user PIN or biometric authentication.

The CVSS score of 6.3 indicates moderate severity; the EPSS score is not available, and it is not listed in CISA’s KEV catalog. Exploitation is constrained to local devices where an attacker’s app can be installed and the user has unlocked FairEmail. Because the attacker must provide a malicious attachment and the user must manually unlock the app, the risk is moderate but significant, especially on unlocked personal devices or where strong app‑level authentication is absent.