CVE-2026-38093: n/a

CVE-2026-38093 describes a path traversal vulnerability (CWE-22) in the flutter_file_picker plugin for Flutter, affecting all versions through 10.3.10. The issue is in the Android-specific code where the openFileStream() method in FileUtils.kt uses the DISPLAY_NAME obtained from ContentResolver.query() directly in file path construction without sanitization. A malicious app can exploit this by providing a crafted ContentProvider that returns filenames containing '../' sequences, enabling creation of arbitrary files and directories outside the intended cache directory within the victim app's internal storage. The vulnerability does not overwrite existing files due to an existence check. There is no vendor advisory or patch information available at this time.

An attacker controlling a malicious Android app can exploit this vulnerability to create arbitrary files and directories outside the intended cache directory of the victim app's internal storage. This could lead to unauthorized file creation but does not allow overwriting existing files. The impact is limited to integrity loss without confidentiality or availability impact. The CVSS score is low (3.3), reflecting limited impact and the requirement for local privileges (a malicious app installed on the device).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid using untrusted ContentProviders with the flutter_file_picker plugin on Android. Monitor vendor channels for updates or patches addressing this path traversal issue.