CVE-2026-81301 Ekia File Manager 1.2.7 - Exported ContentProvider allows unauthorized file access
A local attacker can read, modify, or delete files via an exported ContentProvider in Ekia File Manager due to missing permission checks and path validation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-81301?
CVE-2026-81301 is a high-severity path traversal vulnerability in Ekia File Manager, published on 14 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Ekia File Manager 1.2.7 exposes com.ekia.filecontrolmanager.OpenFileProvider as an exported Android ContentProvider without requiring caller permissions.
The provider maps the caller-controlled URI path directly to a filesystem path and passes it to new File(...). It then supports query(), openFile(), and delete() operations. Because the provider is exported and lacks android:permission, android:readPermission, or android:writePermission, another local application can access the provider authority and cause File Manager's process to read, create, overwrite, or delete files that are accessible to that process.
Weakness: CWE-926
Which versions are affected by CVE-2026-81301?
How do I fix CVE-2026-81301?
No fix has been published for CVE-2026-81301 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-81301 being exploited?
There is no known exploitation of CVE-2026-81301 in the wild and no public exploit code.
Sources
Also known as GHSA-jjh4-j2rc-jqhg.