Executive brief
Ekia File Manager is an Android application that provides file browsing and management functionality. The app exposes an internal content provider component without proper access controls, allowing any other app on the device to read, create, overwrite, or delete files that the File Manager app can access. This could enable local apps to manipulate user data, configuration files, or sensitive documents stored on the device.
Technical details
The vulnerability is an insecure exported ContentProvider (com.ekia.filecontrolmanager.OpenFileProvider) that lacks permission enforcement through android:permission, android:readPermission, or android:writePermission attributes. The provider directly maps caller-controlled URI paths to filesystem paths via new File(...) and supports query(), openFile(), and delete() operations. An unprivileged local application can invoke these operations to access files with the privileges of the File Manager process, bypassing Android's typical file access controls. No patch information is currently available in the advisory.
Affected products
- Ekia File Manager 1.2.7
Timeline
- 2026-09-14: disclosed