{"id":"CVE-2026-107052","aliases":[],"cve":{"records":[{"id":"CVE-2026-107052","source":"mitre","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-10-07T00:00:00.000Z","published":"2026-10-29T00:00:00.000Z","modified":"2026-10-29T19:56:53.213Z"}],"publishers":[{"name":"mitre","role":"CNA","organizationId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","modified":"2026-10-29T16:45:25.143Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-10-29T19:56:53.213Z"}],"references":[{"url":"https://bitbucket.org/projectmaxs/maxs","tags":[],"source":"mitre"},{"url":"https://f-droid.org/packages/org.projectmaxs.module.fileread/","tags":[],"source":"mitre"},{"url":"https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107052.md","tags":[],"source":"mitre"},{"url":"https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107052.md","tags":["exploit"],"source":"CISA-ADP"}],"weaknesses":[{"id":"CWE-276","description":"CWE-276 Incorrect Default Permissions","source":"CISA-ADP"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-10-29T19:55:55.571046Z","decisions":[{"name":"Exploitation","value":"poc"},{"name":"Automatable","value":"yes"},{"name":"Technical Impact","value":"partial"}]}]},"title":"Insecure permissions in the AIDL interface of ProjectMAXS MAXS Module FileRead versionCode 27 allows unauthorized attackers to arbitrarily reead files…","titleSource":"mitre","descriptionSource":"mitre","description":"Insecure permissions in the AIDL interface of ProjectMAXS MAXS Module FileRead versionCode 27 allows unauthorized attackers to arbitrarily reead files outside of the sandbox via providing an absolute path.","score":7.5,"severity":"high","published":"2026-10-29T00:00:00.000Z","modified":"2026-10-29T19:56:53.213Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"n/a","name":"n/a","platforms":[],"versions":[{"version":"n/a","status":"affected"}],"cpes":[],"source":"mitre","url":"https://www.cve.org/CVERecord?id=CVE-2026-107052"}],"remediation":[],"references":["https://bitbucket.org/projectmaxs/maxs","https://f-droid.org/packages/org.projectmaxs.module.fileread/","https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107052.md"],"sources":[{"name":"CVE","id":"CVE-2026-107052","modified":"2026-10-29T19:56:53.213Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-107052"}],"assessments":[{"source":"CISA-ADP","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","score":7.5}],"sourceAffected":[],"observedAt":"2026-10-29T20:45:26.936Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T03:00:33.317Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-10-30T06:55:33.081Z","attemptedAt":"2026-10-30T06:55:33.081Z"},{"source":"GHSA","status":"available","checkedAt":"2026-10-30T06:55:33.035Z","attemptedAt":"2026-10-30T06:55:33.035Z"},{"source":"EUVD","status":"available","checkedAt":"2026-10-30T06:55:32.695Z","attemptedAt":"2026-10-30T06:55:32.695Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-10-30T06:55:32.603Z","attemptedAt":"2026-10-30T06:55:32.603Z"}],"evidence":[{"source":"ENISA EUVD","id":"EUVD-2026-113261","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-113261","modified":"Oct 29, 2026, 7:56:53 PM","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","checkedAt":"2026-10-30T06:55:32.695Z"},{"source":"GitHub Advisory Database","id":"GHSA-669w-gvvp-f77q","url":"https://github.com/advisories/GHSA-669w-gvvp-f77q","modified":"2026-10-29T21:31:26Z","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","checkedAt":"2026-10-30T06:55:33.035Z"},{"source":"NVD","id":"CVE-2026-107052","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107052","modified":"2026-10-29T20:17:25.060","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","checkedAt":"2026-10-30T06:55:33.081Z"}],"aiSummary":{"text":"ProjectMAXS MAXS Module FileRead versionCode 27 has insecure permissions in its AIDL interface, allowing unauthorized attackers to read files outside the sandbox. The weakness is due to incorrect default permissions. Attackers can provide an absolute path to exploit this vulnerability.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-30T09:45:13.891Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-107052"}]}}