Executive brief
ZTE File Manager is a pre-installed application on ZTE mobile devices used for organizing and viewing files. A security flaw in how the app handles file previews allows other malicious apps on the same device to bypass standard security boundaries. This could allow an attacker to read sensitive system files or private data from other applications that should normally be protected.
Technical details
A path traversal vulnerability (CWE-22) exists in the zte.com.cn.filer.FilePreViewActivity component of the ZTE File Manager. The activity is exported or otherwise accessible to third-party applications, which can launch it and provide arbitrary file paths via a FileProvider (e.g., content://zte.com.cn.filer.fileprovider/root_path). Because the activity operates with the elevated privileges of the ZTE File Manager, it can be coerced into reading files from protected system directories such as /data/data and /data/local/tmp. Exploitation requires physical access to the device and user interaction, resulting in a low CVSS score. A fix was released in updates following May 30, 2026.
Affected products
- ZTE A75 Pro 5G (ZTE File Manager) Versions released before 2026/05/30
Timeline
- 2026-05-30: patched: Versions released after this date are unaffected.
- 2026-07-27: disclosed: Initial public advisory published.