Funny bug in Task.org, which is an open source reminder and todo list tracking app. The vulnerability is lack of path validation in the ShareLinkActivity’s share intent. The activity will accept arbitrary paths intended as “attachment files”, which will copy the file into the app’s external storage directory. An attacker can provide a path to Task.org internal storage files (such as the user local database or preference files) and copy them to the publicly accessible external storage. It’s possible the database can contain credentials for CalDAV integration if it’s enabled, though passwords are encrypted, mitigating the impact.