CVE-2026-81301
2026-09-14
16h17 +00:00
16h17 +00:00
特定のCVEの通知
特定のCVEの変更情報をいち早くお届けします。
CVE の説明
Ekia File Manager 1.2.7 exposes com.ekia.filecontrolmanager.OpenFileProvider as an exported Android ContentProvider without requiring caller permissions.
The provider maps the caller-controlled URI path directly to a filesystem path and passes it to new File(...). It then supports query(), openFile(), and delete() operations. Because the provider is exported and lacks android:permission, android:readPermission, or android:writePermission, another local application can access the provider authority and cause File Manager's process to read, create, overwrite, or delete files that are accessible to that process.
CVE の情報
関連する弱点
| 弱点名 | 出典 | |
|---|---|---|
| Improper Export of Android Application Components The Android application exports a component for use by other applications, but does not properly restrict which applications can launch the component or access the data it contains. |
