{"id":"CVE-2026-81301","aliases":[],"url":"https://o3.security/vulnerability/CVE-2026-81301","summary":"Ekia File Manager 1.2.7 exposes com.ekia.filecontrolmanager.OpenFileProvider as an exported Android ContentProvider without requiring caller permissions.\n\nThe provider maps the caller-controlled…","details":"Ekia File Manager 1.2.7 exposes com.ekia.filecontrolmanager.OpenFileProvider as an exported Android ContentProvider without requiring caller permissions.\n\nThe provider maps the caller-controlled URI path directly to a filesystem path and passes it to new File(...). It then supports query(), openFile(), and delete() operations. Because the provider is exported and lacks android:permission, android:readPermission, or android:writePermission, another local application can access the provider authority and cause File Manager's process to read, create, overwrite, or delete files that are accessible to that process.","published":"2026-09-14T16:17:19.360","modified":"2026-09-14T16:17:19.360","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[],"fix":null,"references":[{"type":"WEB","url":"https://fluidattacks.com/advisories/waking"},{"type":"WEB","url":"https://play.google.com/store/apps/details?id=com.ekia.files.manager"}],"provenance":{"sources":["OSV.dev","NVD","FIRST.org (EPSS)"],"lastVerified":"2026-09-14T16:17:19.360"}}