Leafpad: Exported Android component allows writing notes without permission

Summary

Leafpad for Android, version 1.21, exports an activity that needs no permission. Any app installed on the same device can send text to it, and the text is saved as a new note in the app's database without user interaction. The reporter demonstrated this with a test app, and the injected notes persisted after a restart. The NVD score of 9.1 assumes a network attack, while another source rates the attack as local, so the actual exposure is still disputed.

Affected

• Leafpad 1.21 (versionCode 21) for Android, according to the CVE record and the advisory
• Versions 1.22 to 1.24: unknown, not yet confirmed

Fixed in

Unknown. The advisory states that no fix had been released by the upstream project as of 2026-09-27. The release notes for 1.24 describe UI changes only and no security fix.

Workaround

• Unknown. No vendor-confirmed workaround is available.
• Do not store confidential information in the app until a fix is confirmed.
• Restrict installation of unknown apps on company devices.

Exploitation

• No known in-the-wild exploitation.
• Not listed in CISA KEV.
• A reporter-verified proof of concept exists in the advisory; no public exploit is confirmed by other sources.
• CISA SSVC: exploitation status poc, automatable yes, technical impact total.

Our recommendation

• Check whether Leafpad is installed on company or staff devices.
• Uninstall Leafpad or stop using it for confidential notes until the advisory confirms a fixed version.
• Monitor the advisory and the F-Droid listing for an updated release.
• Keep devices protected with a screen lock and device encryption.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• F-Droid: Leafpad package f-droid.org
• Advisory CVE-2026-107034 (FFG0d/fdroid-android-advisories) github.com
• Upstream repository: amarradi/leafpad_Android github.com
• VulDB entry 428564 vuldb.com
• Strix: CVE-2026-107034 www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 05:12.