CVE-2026-81301: CWE-926 Improper Export of Android Application Components in Ekia File Manager
Ekia File Manager 1.2.7 exposes com.ekia.filecontrolmanager.OpenFileProvider as an exported Android ContentProvider without requiring caller permissions. The provider maps the caller-controlled URI path directly to a filesystem path and passes it to new File(...). It then supports query(), openFile(), and delete() operations. Because the provider is exported and lacks android:permission, android:readPermission, or android:writePermission, another local application can access the provider authority and cause File Manager's process to read, create, overwrite, or delete files that are accessible to that process.
AI Analysis
Technical Summary
CVE-2026-81301 describes a security flaw in Ekia File Manager 1.2.7 where the exported Android ContentProvider com.ekia.filecontrolmanager.OpenFileProvider lacks required permission enforcement (android:permission, android:readPermission, android:writePermission). The provider directly maps URI paths controlled by the caller to filesystem paths and supports query(), openFile(), and delete() operations. Due to the absence of permission restrictions, any local application can invoke this provider to manipulate files accessible by the File Manager process, potentially leading to unauthorized file read, creation, modification, or deletion.
Potential Impact
An unprivileged local application can exploit this vulnerability to access and manipulate files accessible to the Ekia File Manager process. This can result in unauthorized disclosure, modification, or deletion of files, potentially impacting data integrity and confidentiality within the affected device environment.
Mitigation Recommendations
No official patch or remediation guidance is currently provided by the vendor. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict installation of untrusted local applications and consider limiting access to the vulnerable component if possible.
CVE-2026-81301: CWE-926 Improper Export of Android Application Components in Ekia File Manager
Description
Ekia File Manager 1.2.7 exposes com.ekia.filecontrolmanager.OpenFileProvider as an exported Android ContentProvider without requiring caller permissions. The provider maps the caller-controlled URI path directly to a filesystem path and passes it to new File(...). It then supports query(), openFile(), and delete() operations. Because the provider is exported and lacks android:permission, android:readPermission, or android:writePermission, another local application can access the provider authority and cause File Manager's process to read, create, overwrite, or delete files that are accessible to that process.
CVSS v4.0
Score 8.5high
Affected software
Ekia
File Manager
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-81301 describes a security flaw in Ekia File Manager 1.2.7 where the exported Android ContentProvider com.ekia.filecontrolmanager.OpenFileProvider lacks required permission enforcement (android:permission, android:readPermission, android:writePermission). The provider directly maps URI paths controlled by the caller to filesystem paths and supports query(), openFile(), and delete() operations. Due to the absence of permission restrictions, any local application can invoke this provider to manipulate files accessible by the File Manager process, potentially leading to unauthorized file read, creation, modification, or deletion.
Potential Impact
An unprivileged local application can exploit this vulnerability to access and manipulate files accessible to the Ekia File Manager process. This can result in unauthorized disclosure, modification, or deletion of files, potentially impacting data integrity and confidentiality within the affected device environment.
Mitigation Recommendations
No official patch or remediation guidance is currently provided by the vendor. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict installation of untrusted local applications and consider limiting access to the vulnerable component if possible.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Fluid Attacks
- Date Reserved
- 2026-08-26T17:38:45.889Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6aa81a7c55bf5e2cf54846cd
Added to database: 09/14/2026, 16:02:04 UTC
Last enriched: 09/14/2026, 16:16:27 UTC
Last updated: 09/15/2026, 03:34:58 UTC
Views: 14
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.