CVE-2026-107029

{"dataType": "CVE_RECORD", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2026-107029", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2026-11-03T00:26:45.611Z", "dateReserved": "2026-10-07T00:00:00.000Z", "datePublished": "2026-10-29T00:00:00.000Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-10-29T15:20:09.692Z"}, "descriptions": [{"lang": "en", "value": "Insecure permissions in rubenalfon Pile v1.1.3 allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and overwriting."}], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"version": "n/a", "status": "affected"}]}], "references": [{"url": "https://f-droid.org/packages/es.pile/"}, {"url": "https://github.com/rubenalfon/Pile"}, {"url": "https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107029.md"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "n/a"}]}]}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-732", "lang": "en", "description": "CWE-732 Incorrect Permission Assignment for Critical Resource"}]}], "references": [{"url": "https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107029.md", "tags": ["exploit"]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-11-03T00:25:49.496348Z", "id": "CVE-2026-107029", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-03T00:26:45.611Z"}}]}, "dataVersion": "5.2"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-107029", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-11-03T00:25:49.496348Z"}}}], "references": [{"url": "https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107029.md", "tags": ["exploit"]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-732", "description": "CWE-732 Incorrect Permission Assignment for Critical Resource"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-03T00:26:05.487Z"}}], "cna": {"affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "references": [{"url": "https://f-droid.org/packages/es.pile/"}, {"url": "https://github.com/rubenalfon/Pile"}, {"url": "https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107029.md"}], "descriptions": [{"lang": "en", "value": "Insecure permissions in rubenalfon Pile v1.1.3 allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and overwriting."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "n/a"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-10-29T15:20:09.692Z"}}}, "cveMetadata": {"cveId": "CVE-2026-107029", "state": "PUBLISHED", "dateUpdated": "2026-11-03T00:26:45.611Z", "dateReserved": "2026-10-07T00:00:00.000Z", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2026-10-29T00:00:00.000Z", "assignerShortName": "mitre"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "source": "cve@mitre.org"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Insecure permissions in rubenalfon Pile v1.1.3 allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and overwriting."}], "id": "CVE-2026-107029", "lastModified": "2026-11-03T01:16:47.743", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.2, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-107029", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-11-03T00:25:49.496348Z", "version": "2.0.3"}}]}, "published": "2026-10-29T16:17:48.723", "references": [{"source": "cve@mitre.org", "url": "https://f-droid.org/packages/es.pile/"}, {"source": "cve@mitre.org", "url": "https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107029.md"}, {"source": "cve@mitre.org", "url": "https://github.com/rubenalfon/Pile"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107029.md"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-732"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"bugzilla": {"description": "Pile: Pile: unauthorized data access via insecure exported component permissions", "id": "2563527", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2563527"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.7", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "status": "draft"}, "cwe": "CWE-749", "details": ["Insecure permissions in rubenalfon Pile v1.1.3 allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and overwriting.", "A flaw was found in Pile. Due to insecure permission settings, an unauthorized attacker can invoke an exported application component. This vulnerability allows an attacker to access and overwrite arbitrary application data."], "name": "CVE-2026-107029", "public_date": "2026-10-29T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-107029\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-107029\nhttps://f-droid.org/packages/es.pile/\nhttps://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107029.md\nhttps://github.com/rubenalfon/Pile"], "statement": "This vulnerability is rated as Important because improper permission configurations on exported components allow unauthorized callers to read and modify internal application data without restriction. However, Red Hat does not package or support the Pile mobile application across any enterprise product lines. Consequently, Red Hat supported environments are not affected by this issue.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.1.3,*]"}}], "enrichment": {"confidence": 85.0, "confidence_source": "inferred", "scores": [{"score": 85.0, "source": "inferred"}]}, "original": {"product": "n/a", "source": "cna", "vendor": "n/a"}, "product": "pile", "vendor": "rubenalfon"}], "created": "2026-10-29T18:45:14.336770+00:00", "updated": "2026-11-06T02:15:18.147195+00:00", "vendors": ["rubenalfon", "rubenalfon$PRODUCT$pile"]}