{"id":"CVE-2026-107055","aliases":[],"cve":{"records":[{"id":"CVE-2026-107055","source":"mitre","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-10-07T00:00:00.000Z","published":"2026-10-29T00:00:00.000Z","modified":"2026-10-30T18:37:53.151Z"}],"publishers":[{"name":"mitre","role":"CNA","organizationId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","modified":"2026-10-29T16:48:57.946Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-10-30T18:37:53.151Z"}],"references":[{"url":"https://f-droid.org/packages/com.appmindlab.nano/","tags":[],"source":"mitre"},{"url":"https://github.com/appml/neutrinote","tags":[],"source":"mitre"},{"url":"https://github.com/appml/neutrinote/issues/71","tags":[],"source":"mitre"},{"url":"https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107055.md","tags":[],"source":"mitre"},{"url":"https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107055.md","tags":["exploit"],"source":"CISA-ADP"}],"weaknesses":[{"id":"CWE-732","description":"CWE-732 Incorrect Permission Assignment for Critical Resource","source":"CISA-ADP"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-10-30T17:59:37.508493Z","decisions":[{"name":"Exploitation","value":"poc"},{"name":"Automatable","value":"yes"},{"name":"Technical Impact","value":"partial"}]}]},"title":"Insecure permissions in the autosave component of AppML neutriNote CE versionCode 1387 allows unauthorized attackers to write arbitrary files.","titleSource":"mitre","descriptionSource":"mitre","description":"Insecure permissions in the autosave component of AppML neutriNote CE versionCode 1387 allows unauthorized attackers to write arbitrary files.","score":7.5,"severity":"high","published":"2026-10-29T00:00:00.000Z","modified":"2026-10-30T18:37:53.151Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"n/a","name":"n/a","platforms":[],"versions":[{"version":"n/a","status":"affected"}],"cpes":[],"source":"mitre","url":"https://www.cve.org/CVERecord?id=CVE-2026-107055"}],"remediation":[],"references":["https://f-droid.org/packages/com.appmindlab.nano/","https://github.com/appml/neutrinote","https://github.com/appml/neutrinote/issues/71","https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107055.md"],"sources":[{"name":"CVE","id":"CVE-2026-107055","modified":"2026-10-30T18:37:53.151Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-107055"}],"assessments":[{"source":"CISA-ADP","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","score":7.5}],"sourceAffected":[],"observedAt":"2026-10-30T18:57:29.421Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T00:55:33.128Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-10-30T10:05:34.215Z","attemptedAt":"2026-10-30T10:05:34.215Z"},{"source":"GHSA","status":"available","checkedAt":"2026-10-30T10:05:34.426Z","attemptedAt":"2026-10-30T10:05:34.426Z"},{"source":"EUVD","status":"available","checkedAt":"2026-10-30T10:05:34.972Z","attemptedAt":"2026-10-30T10:05:34.972Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-10-30T10:05:34.122Z","attemptedAt":"2026-10-30T10:05:34.122Z"}],"evidence":[{"source":"NVD","id":"CVE-2026-107055","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107055","modified":"2026-10-29T17:17:58.190","checkedAt":"2026-10-30T10:05:34.215Z"},{"source":"GitHub Advisory Database","id":"GHSA-mc9v-rvgx-8p2j","url":"https://github.com/advisories/GHSA-mc9v-rvgx-8p2j","modified":"2026-10-29T18:31:11Z","checkedAt":"2026-10-30T10:05:34.426Z"},{"source":"ENISA EUVD","id":"EUVD-2026-113259","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-113259","modified":"Oct 29, 2026, 4:48:57 PM","checkedAt":"2026-10-30T10:05:34.972Z"}],"aiSummary":{"text":"AppML neutriNote CE versionCode 1387 has insecure permissions in its autosave component, potentially allowing unauthorized attackers to write arbitrary files. The weakness is due to incorrect permission assignment. Impact is uncertain.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-31T10:11:01.896Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-107055"}]}}