Path traversal in deeplink query parameter can expose any user's private info to a public directory (one click)

It was found that the basecamp.bc3 app can be forced to expose the user's private info (any), to the device's shared directory which is accessible by any 3p app with READ/MANAGE external storage permissions.

[------------------------------------Package Details---------------------------------------]:
|    Application Name  :Basecamp
|    Package Name      :com.basecamp.bc3
|    Version code      :380
|    Version Name      :4.8.6
|    Mimimum SDK       :28
|    Target  SDK       :34
|    Max SDK …