---
id: CVE-2026-38093
title: >-
  file_picker (aka flutter_file_picker) for Flutter, all versions through
  10.3.10, is vulnerable to path traversal (CWE-22) in its Android
  implementation
summary: >-
  file_picker (aka flutter_file_picker) for Flutter, all versions through
  10.3.10, is vulnerable to path traversal (CWE-22) in its Android
  implementation. The openFileStream() method in FileUtils.kt uses the
  DISPLAY_NAME obtained from Cont…
severity: low
cvss: 3.3
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'
cwe:
  - CWE-22
published: '2026-08-28'
updated: '2026-09-09'
sourceUpdated: '2026-09-09T16:04:24.933'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-38093'
references:
  - url: 'https://github.com/miguelpruivo/flutter_file_picker'
    label: cve@mitre.org
  - url: 'https://github.com/miguelpruivo/flutter_file_picker/issues/1967'
    label: cve@mitre.org
  - url: 'https://pub.dev/packages/file_picker'
    label: cve@mitre.org
tags:
  - nvd
epss: 0.00162
epssPercentile: 0.04605
ingestedAt: '2026-09-09T16:14:05.517Z'
---

## Overview

file_picker (aka flutter_file_picker) for Flutter, all versions through 10.3.10, is vulnerable to path traversal (CWE-22) in its Android implementation. The openFileStream() method in FileUtils.kt uses the DISPLAY_NAME obtained from ContentResolver.query() directly in file path construction without sanitization. A malicious Android app with a crafted ContentProvider can return a filename containing ../ sequences, causing the plugin to create arbitrary files and directories outside the intended cache directory within the victim app's internal storage. Existing files are not overwritten due to an existence check.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.