The vulnerability exists in the zte.com.cn.filer.FilePreViewActivity within ZTE File Manager on the Blade A75 5G device. This Activity can be launched by third-party applications that supply arbitrary file paths, enabling file access with the privileges of the ZTE File Manager app. This improper limitation of pathname to a restricted directory (CWE-22) allows reading files from certain system directories on unrooted devices. The vulnerability does not require elevated privileges but does require user interaction (UI:R). The CVSS vector indicates low impact on confidentiality and no impact on integrity or availability.

An attacker controlling a third-party application can leverage this vulnerability to read files in restricted system directories on unrooted devices, potentially exposing sensitive information stored in those directories. However, the impact is limited to information disclosure with no integrity or availability effects. The low CVSS score reflects the high attack complexity and required user interaction.

No official patch or remediation guidance is currently available from the vendor. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, users should avoid installing untrusted third-party applications that might exploit this vulnerability.