High · 7.5 CVE-2026-107052 EUVD-2026-113261GHSA-669w-gvvp-f77q

Insecure permissions in the AIDL interface of ProjectMAXS MAXS Module FileRead versionCode 27 allows unauthorized attackers to arbitrarily …

Published Oct 29, 2026 · Updated Oct 29, 2026 · Assigned by mitre

Description

Insecure permissions in the AIDL interface of ProjectMAXS MAXS Module FileRead versionCode 27 allows unauthorized attackers to arbitrarily reead files outside of the sandbox via providing an absolute path.

References

https://bitbucket.org/projectmaxs/maxs
https://f-droid.org/packages/org.projectmaxs.module.fileread/
https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107052.md