CVE-2026-107052

EUVD-2026-113261
Insecure permissions in the AIDL interface of ProjectMAXS MAXS Module FileRead versionCode 27 allows unauthorized attackers to arbitrarily reead files outside of the sandbox via providing an absolute path.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Common Weakness Enumeration
References
https://bitbucket.org/projectmaxs/maxs
https://f-droid.org/packages/org.projectmaxs.module.fileread/
https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107052.md
https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107052.md