CVE-2026-11319 TickTick Limited CVE debrief

Who should care

Defenders responsible for managing and securing Android applications, particularly those using the TickTick application, should assess exposure to potential path traversal attacks and prioritize verification of the application version.

Why it matters

The path traversal vulnerability in the TickTick Android application allows a malicious local application to write files outside the intended attachment directory, potentially leading to security risks. Defenders should prioritize verification of the application version and assess exposure to potential path traversal attacks.

• Verify application version to determine exposure
• Assess potential for path traversal attacks
• Implement compensating controls to prevent file writes to attacker-chosen locations
• Monitor for suspicious activity related to the TickTick application

Technical summary

The TickTick Android application, version 8.2.2.0, contains a path traversal vulnerability in its exported ShareReceiveActivity. A malicious local application can write files outside the intended attachment directory by supplying a crafted content:// URI with a traversal filename via ACTION_SEND intents. The vulnerability is caused by the application's failure to properly sanitize filenames when handling content:// URIs. This allows a malicious application to register a ContentProvider returning a _display_name value containing traversal sequences, which is passed unsanitized through FileManager.getDisplayNameFromUri and AttachmentFileHelper.copyFileDirectly.

Defensive priority

Defenders should prioritize verifying the TickTick Android application version and assessing exposure to potential path traversal attacks.

Recommended defensive actions

• Verify TickTick Android application version
• Assess exposure to potential path traversal attacks
• Implement compensating controls to prevent file writes to attacker-chosen locations
• Monitor for suspicious activity related to the TickTick application
• Review vendor guidance for affected product deployments
• Track exceptions and retest remediated assets
• technicalSummary

Evidence notes

The CVE record and source item provide details on the path traversal vulnerability in the TickTick Android application, version 8.2.2.0. The vulnerability is caused by the application's failure to properly sanitize filenames when handling content:// URIs. This allows a malicious application to register a ContentProvider returning a _display_name value containing traversal sequences, which is passed unsanitized through FileManager.getDisplayNameFromUri and AttachmentFileHelper.copyFileDirectly, causing automatic file writes to attacker

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.