# Path traversal in deeplink query parameter can expose any user's private info to a public directory (one click)

Basecamp Android app's deeplink filename parameter allowed path traversal, writing private reports to shared /sdcard/Download readable by any third-party app.

- Payout: hidden
- Severity: medium
- Program: Basecamp
- Found by: fr4via
- Disclosed: 2024-07-09
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/2553411
- Library page: https://bugbountylibrary.com/r/h1%3A2553411
- Tags: area:mobile domain:mobile impact:data-leak impact:pii-leak kind:bounty platform:hackerone sev:medium tech:android technique:source-review vuln:path-traversal

**Target:** Android app deeplink handler (com.basecamp.bc3) saving files via filename parameter
**Root cause:** The deeplink handler accepts a user-controlled 'filename' query parameter and uses it directly as a save path without sanitizing path traversal sequences, allowing writes outside the app sandbox.
**Steps:**
1. Craft deeplink `https://3.basecamp.com/5195267/reports/progress?filename=/../../../../../../../../../../sdcard/Download/disclosure.txt`
2. Deliver link to victim (e.g. embed in a Basecamp comment/project)
3. Victim clicks link; app saves progress report to /sdcard/Download/disclosure.txt
4. Any third-party app with READ/MANAGE external storage reads the exposed file
**How found:** Noticed the app declares deeplink handling for https://3.basecamp.com/* and that a 'filename' parameter controls local save path; hypothesized traversal sequences would escape the intended directory.
**Exploitation:** Attacker embeds a crafted deeplink in Basecamp comments/projects; when the victim taps it, the app writes the private progress report to a world-readable shared storage path, which any installed app with external storage permission can then read.
**Insight:** Mobile deeplink handlers that accept a filename/path parameter for local saves are prime traversal targets; test whether the resulting write lands in shared external storage readable by other apps, turning a file-write into a data-leak.