What’s Vulnerable › Vulnerabilities

CVE-2026-81301: Ekia File Manager 1.2.7 - Exported ContentProvider allows unauthorized file access

• Severity: high (CVSS 8.5 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-14 · updated 2026-09-18
• Weakness: CWE-926

Description

Ekia File Manager 1.2.7 exposes com.ekia.filecontrolmanager.OpenFileProvider as an exported Android ContentProvider without requiring caller permissions. The provider maps the caller-controlled URI path directly to a filesystem path and passes it to new File(...). It then supports query(), openFile(), and delete() operations. Because the provider is exported and lacks android:permission, android:readPermission, or android:writePermission, another local application can access the provider authority and cause File Manager's process to read, create, overwrite, or delete files that are accessible to that process.

Affected products

• Ekia File Manager: 1.2.7

References

• https://fluidattacks.com/advisories/waking
• https://play.google.com/store/apps/details?id=com.ekia.files.manager

Get alerted when CVE-2026-81301 or the next vulnerability affects your stack