CVE-2026-58128

Name of the Vulnerable Software and Affected Versions Alan: Health Insurance for Android version 1.450.0

Description A path traversal issue exists where a co-resident malicious application can write attacker-controlled files outside the intended directory. This occurs via the exported ShareReceiverActivity, which uses an unsanitized display name value from a shared content URI to construct the destination file path. An attacker can send a crafted ACTION SEND intent containing directory traversal sequences in the display name to overwrite sensitive files within the app sandbox, including databases, shared prefs, and WebView data. This can lead to state tampering or code execution within the app context without authentication or user interaction.

Recommendations Update Alan: Health Insurance for Android to a version newer than 1.450.0. As a temporary mitigation, restrict the use of the ShareReceiverActivity.