---
id: CVE-2026-81301
title: >-
  Ekia File Manager 1.2.7 exposes com.ekia.filecontrolmanager.OpenFileProvider
  as an exported Android ContentProvider without requiring caller permissions.


  The provider maps the caller-controlled URI path directly to a filesystem path
  and…
summary: >-
  Ekia File Manager 1.2.7 exposes com.ekia.filecontrolmanager.OpenFileProvider
  as an exported Android ContentProvider without requiring caller permissions.


  The provider maps the caller-controlled URI path directly to a filesystem path
  and…
severity: high
cvss: 8.5
cvssVector: 'CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N'
cwe:
  - CWE-926
vendor: Ekia
product: File Manager
affected:
  - file_manager 1.2.7
published: '2026-09-14'
updated: '2026-09-18'
sourceUpdated: '2026-09-18T19:44:10.957'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-81301'
references:
  - url: 'https://fluidattacks.com/advisories/waking'
    label: help@fluidattacks.com
  - url: 'https://play.google.com/store/apps/details?id=com.ekia.files.manager'
    label: help@fluidattacks.com
tags:
  - nvd
  - cve.org
epss: 0.00161
epssPercentile: 0.04589
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-09-14T19:12:18.350031Z'
cvssSource: cna
ingestedAt: '2026-09-14T17:11:16.565Z'
---

## Overview

Ekia File Manager 1.2.7 exposes com.ekia.filecontrolmanager.OpenFileProvider as an exported Android ContentProvider without requiring caller permissions.

The provider maps the caller-controlled URI path directly to a filesystem path and passes it to new File(...). It then supports query(), openFile(), and delete() operations. Because the provider is exported and lacks android:permission, android:readPermission, or android:writePermission, another local application can access the provider authority and cause File Manager's process to read, create, overwrite, or delete files that are accessible to that process.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.