Executive brief
flutter_file_picker is a popular file selection plugin for Flutter applications. A vulnerability in its Android implementation allows a malicious app to craft a fake file provider that tricks the plugin into creating files and directories outside its intended storage location. An attacker could exploit this to write files to sensitive areas of a victim app's storage, potentially compromising app integrity or functionality.
Technical details
The vulnerability is a path traversal flaw (CWE-22) in the openFileStream() method of FileUtils.kt in the Android implementation. The method directly uses the DISPLAY_NAME returned by ContentResolver.query() in file path construction without sanitizing path traversal sequences like "../". A malicious Android app can register a crafted ContentProvider that returns filenames containing ".." sequences, causing the plugin to create arbitrary files and directories outside the intended cache directory within the victim app's internal storage. While existing files are not overwritten due to an existence check, an attacker can still create new files at arbitrary locations. Network access is not required; exploitation requires a malicious app installed on the same device.
Affected products
- flutter_file_picker file_picker all versions through 10.3.10
Timeline
- 2026-08-28: disclosed