CVE-2026-81301: Ekia File Manager 1.2.7 - Exported ContentProvider allows unauthorized file access
Ekia File Manager 1.2.7 exposes com.ekia.filecontrolmanager.OpenFileProvider as an exported Android ContentProvider without requiring caller permissions.
The provider maps the caller-controlled URI path directly to a filesystem path and passes it to new File(...). It then supports query(), openFile(), and delete() operations. Because the provider is exported and lacks android:permission, android:readPermission, or android:writePermission, another local application can access the provider authority and cause File Manager's process to read, create, overwrite, or delete files that are accessible to that process.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any other application installed on the same Android device can invoke the exported provider. The calling application does not need the provider's read or write permission because none is required.
What access can an attacker obtain through the provider?
A malicious local application can use caller-controlled URI paths with query(), openFile(), and delete() to read, create, overwrite, or delete files that the File Manager process itself can access.
Is user interaction or network access required?
The described attack is local: an attacker needs to run an application on the affected Android device and access the provider authority. The data does not describe a network-based attack or a user approval step.