CVE-2026-81301 — Ekia File Manager 1.2.7 - Exported ContentProvider allows unauthorized file access
Ekia File Manager 1.2.7 exposes com.ekia.filecontrolmanager.OpenFileProvider as an exported Android ContentProvider without requiring caller permissions. The provider maps the …
Published: 2026-09-14 · CVSS: 8.5 · CVSS 4.0
Ekia File Manager 1.2.7 exposes com.ekia.filecontrolmanager.OpenFileProvider as an exported Android ContentProvider without requiring caller permissions. The provider maps the caller-controlled URI path directly to a filesystem path and passes it to new File(...). It then supports query(), openFile(), and delete() operations. Because the provider is exported and lacks android:permission, android:readPermission, or android:writePermission, another local application can access the provider authority and cause File Manager's process to read, create, overwrite, or delete files that are accessible to that process.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7