BulkShare Android app: Improper export of activity allows link queue injection
Summary
BulkShare 2.1.0 for Android exports the ShareActivity component without permission protection, so any app installed on the same device can invoke it without user interaction and insert arbitrary text into the app's link queue. The injected links can later be shared by the user through the app, which allows manipulated data flow. The NVD status is Deferred and the CVSS score is not confirmed; the product name and version mapping in the CVE conflict with the upstream listings and are unverified.
Affected
- BulkShare (me.alexghr.bulkshare.android.app2) version 2.1.0 according to the CVE record (versionCode 5)
- The F-Droid listing shows version 2.1.0 (versionCode 3); the mapping is unverified
- The CVE names the product 'Bulk Share: Location Sender', which does not match the upstream description of a URL-sharing app
Fixed in
Unknown. No fixed version is known; the upstream project reported no fix as of 2026-09-27.
Workaround
- Uninstall the app from managed devices
- Block the app via MDM if removal is not possible
Exploitation
- The CISA SSVC assessment lists exploitation as 'poc' and automatable as 'yes'; the linked advisory contains a reporter proof of concept
- No known exploitation in the wild; not listed in KEV
Our recommendation
- Check company and BYOD devices for the BulkShare app, especially devices with F-Droid installed
- Remove the app where it is not in business use
- Add the app to the software inventory and monitor for updates from the upstream project
- Verify the affected product and version against the GitHub advisory before relying on the CVE scope
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- F-Droid package page f-droid.org
- GitHub advisory CVE-2026-107032 (FFG0d) github.com
- BulkShare developer repository github.com
- Strix CVE-2026-107032 www.strix.ai
- Sonar rules: CWE overview rules.sonarsource.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 05:13.
Original description (NVD)
Insecure permissions in Bulk Share : Location Sender v2.1.0 (versionCode 5) allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and control of data flow.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.