CVE-2026-68509

Name of the Vulnerable Software and Affected Versions FairEmail versions prior to 1.2325

Description Shared attachment handling fails to properly sanitize filenames controlled by an attacker when constructing the destination path. This allows a local malicious application to provide path components that escape the designated shared attachment directory, enabling the overwriting or corruption of files within the private data directory, such as message or account databases. Successful exploitation requires the app lock feature to be active via PIN or biometric authentication and necessitates user interaction to unlock the application.

Recommendations Update to version 1.2325.