CVE-2026-107052

Impact

Insecure permissions in the AIDL interface of ProjectMAXS MAXS Module FileRead versionCode 27 allows unauthorized attackers to arbitrarily reead files outside of the sandbox via providing an absolute path.

Affected products

Weakness classification

References

• NVD record
• CVE.org record
• GitHub advisory
• https://bitbucket.org/projectmaxs/maxs
• https://f-droid.org/packages/org.projectmaxs.module.fileread/
• https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107052.md