CVE-2026-38093
CVSS Score
3.3
EPSS Score
0.0%
EPSS Percentile
0th
file_picker (aka flutter_file_picker) for Flutter, all versions through 10.3.10, is vulnerable to path traversal (CWE-22) in its Android implementation. The openFileStream() method in FileUtils.kt uses the DISPLAY_NAME obtained from ContentResolver.query() directly in file path construction without sanitization. A malicious Android app with a crafted ContentProvider can return a filename containing ../ sequences, causing the plugin to create arbitrary files and directories outside the intended cache directory within the victim app's internal storage. Existing files are not overwritten due to an existence check.
| Vendor | n/a |
| Product | n/a |
| Published | Aug 28, 2026 |
| Last Updated | Aug 28, 2026 |
Stay Ahead of the Next One
Get instant alerts for n/a n/a
Be the first to know when new low vulnerabilities affecting n/a n/a are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
n/a / n/a
n/a