{"id":"CVE-2026-38093","title":"file_picker (aka flutter_file_picker) for Flutter, all versions through 10.3.10, is vulnerable to path traversal (CWE-22) in its Android implementation","summary":"file_picker (aka flutter_file_picker) for Flutter, all versions through 10.3.10, is vulnerable to path traversal (CWE-22) in its Android implementation. The openFileStream() method in FileUtils.kt uses the DISPLAY_NAME obtained from Cont…","severity":"low","cvss":3.3,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","cwe":["CWE-22"],"published":"2026-08-28","updated":"2026-09-09","sourceUpdated":"2026-09-09T16:04:24.933","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-38093","references":[{"url":"https://github.com/miguelpruivo/flutter_file_picker","label":"cve@mitre.org"},{"url":"https://github.com/miguelpruivo/flutter_file_picker/issues/1967","label":"cve@mitre.org"},{"url":"https://pub.dev/packages/file_picker","label":"cve@mitre.org"}],"tags":["nvd"],"epss":0.00162,"epssPercentile":0.04576,"ingestedAt":"2026-09-09T16:14:05.517Z","slug":"CVE-2026-38093","body":"## Overview\n\nfile_picker (aka flutter_file_picker) for Flutter, all versions through 10.3.10, is vulnerable to path traversal (CWE-22) in its Android implementation. The openFileStream() method in FileUtils.kt uses the DISPLAY_NAME obtained from ContentResolver.query() directly in file path construction without sanitization. A malicious Android app with a crafted ContentProvider can return a filename containing ../ sequences, causing the plugin to create arbitrary files and directories outside the intended cache directory within the victim app's internal storage. Existing files are not overwritten due to an existence check.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":18,"depthScoreParts":{"impact":18.2,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}