CVE-2026-11319 Details
Description
TickTick Android application (com.ticktick.task) 8.2.2.0 contains a path traversal vulnerability in its exported ShareReceiveActivity that allows a malicious local application to write files outside the intended attachment directory by supplying a crafted content:// URI with a traversal filename via ACTION_SEND intents. A malicious application can register a ContentProvider returning a _display_name value containing traversal sequences, which is passed unsanitized through FileManager.getDisplayNameFromUri and AttachmentFileHelper.copyFileDirectly, causing automatic file writes to attacker-chosen locations with TickTick's application privileges.
A path traversal vulnerability has been identified in the TickTick Android application, specifically in version 8.2.2.0. The issue resides within the exported ShareReceiveActivity, where a malicious local application can exploit the attachment import feature. By sending a crafted content URI that includes traversal sequences in the filename through ACTION_SEND intents, the attacker can manipulate file writes to locations outside the designated attachment directory. This vulnerability arises because the application does not properly sanitize the filename before using it to construct file paths, allowing exploitation with TickTick's application privileges.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 19, 2026CISA-ADP
Assessed Oct 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/actuator/com.ticktick.task/ | [email protected] | ExploitTechnical DescriptionVendor |
| https://www.vulncheck.com/advisories/ticktick-android-path-traversal-via-sharereceiveactivity | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| TickTick | <= 8.2.2.0 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 22, 2026 | CVE Modified | CISA-ADP |
| Oct 19, 2026 | New CVE Received | [email protected] |