Vulnerability Description
Ekia File Manager 1.2.7 exposes com.ekia.filecontrolmanager.OpenFileProvider as an exported Android ContentProvider without requiring caller permissions. The provider maps the caller-controlled URI path directly to a filesystem path and passes it to new File(...). It then supports query(), openFile(), and delete() operations. Because the provider is exported and lacks android:permission, android:readPermission, or android:writePermission, another local application can access the provider authority and cause File Manager's process to read, create, overwrite, or delete files that are accessible to that process.
Related Weaknesses (CWE)
References
- https://fluidattacks.com/advisories/waking
- https://play.google.com/store/apps/details?id=com.ekia.files.manager
FAQ
What is CVE-2026-81301?
CVE-2026-81301 is a documented vulnerability. Ekia File Manager 1.2.7 exposes com.ekia.filecontrolmanager.OpenFileProvider as an exported Android ContentProvider without requiring caller permissions. The provider maps the caller-controlled URI p...
How severe is CVE-2026-81301?
CVSS scoring is not yet available for CVE-2026-81301. Check NVD for updates.
Is there a patch for CVE-2026-81301?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.