{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "FairEmail",
          "vendor": "M66B",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.2325"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "FairEmail is a fully featured, open source, privacy-friendly email app for Android. Prior to 1.2325, shared attachment handling does not adequately sanitize an attacker-controlled filename before constructing its destination path. A local attacker-controlled app can therefore supply path components that escape the intended shared attachment directory and overwrite or corrupt files in the FairEmail private data directory, including account or message databases. Exploitation requires app lock using PIN or biometric authentication and user interaction to unlock FairEmail. This issue is fixed in version 1.2325."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-05T22:45:24.203Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/M66B/FairEmail/security/advisories/GHSA-w92m-2v27-mvg9",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/M66B/FairEmail/security/advisories/GHSA-w92m-2v27-mvg9"
        },
        {
          "name": "https://github.com/M66B/FairEmail/commit/538523dded741f7a8a76052de9a69806d357c0f4",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/M66B/FairEmail/commit/538523dded741f7a8a76052de9a69806d357c0f4"
        },
        {
          "name": "https://github.com/M66B/FairEmail/releases/tag/1.2325",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/M66B/FairEmail/releases/tag/1.2325"
        }
      ],
      "source": {
        "advisory": "GHSA-w92m-2v27-mvg9",
        "discovery": "UNKNOWN"
      },
      "title": "FairEmail: Path traversal in shared attachment handling can write files outside the intended shared directory"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-68509",
    "datePublished": "2026-11-05T22:45:24.203Z",
    "dateReserved": "2026-07-30T16:19:08.081Z",
    "dateUpdated": "2026-11-05T22:45:24.203Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-54521",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-18T20:08:04.050901Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-18T20:08:14.389Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "FairEmail",
          "vendor": "M66B",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.2319"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "FairEmail is a fully featured, open source, privacy-friendly email app for Android. Prior to 1.2319, the ActivityAMP AMP message renderer in app/src/main/java/eu/faircode/email/ActivityAMP.java enables JavaScript in its WebView but incompletely sanitizes untrusted message HTML. For non-allowlisted hosts, script.removeAttr(\"src\") leaves inline script elements in the document and does not reject event-handler attributes or javascript: URLs on other elements. A crafted AMP email can execute arbitrary JavaScript when a recipient opens the message and enables the AMP toggle. The script can read the message DOM, exfiltrate message data, and display phishing overlays within the message-body area. Exploitation requires the recipient to enable the AMP toggle, and practical exposure is reduced because AMP email is uncommon. This issue is fixed in version 1.2319."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-17T20:17:47.341Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/M66B/FairEmail/security/advisories/GHSA-r8ff-qr7g-pvw6",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/M66B/FairEmail/security/advisories/GHSA-r8ff-qr7g-pvw6"
        },
        {
          "name": "https://github.com/M66B/FairEmail/commit/fb37bbfabf5e75d08f0cfa6ce9b84469d62a20a0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/M66B/FairEmail/commit/fb37bbfabf5e75d08f0cfa6ce9b84469d62a20a0"
        },
        {
          "name": "https://github.com/M66B/FairEmail/releases/tag/1.2319",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/M66B/FairEmail/releases/tag/1.2319"
        }
      ],
      "source": {
        "advisory": "GHSA-r8ff-qr7g-pvw6",
        "discovery": "UNKNOWN"
      },
      "title": "FairEmail: Cross-site scripting (XSS) in AMP message rendering (ActivityAMP)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-54521",
    "datePublished": "2026-09-17T20:17:47.341Z",
    "dateReserved": "2026-06-15T18:40:01.651Z",
    "dateUpdated": "2026-09-18T20:08:14.389Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}