CVE-2026-81301

Ekia File Manager 1.2.7 for Android exports the ContentProvider com.ekia.filecontrolmanager.OpenFileProvider without any android:permission, readPermission, or writePermission enforcement. The provider maps the caller-controlled URI path directly to a filesystem path (new File(...)) and exposes query(), openFile(), and delete() operations. Any other app installed on the same device can therefore make the File Manager process read, create, overwrite, or delete any file that the File Manager app itself can access, breaking Android's app-sandbox isolation for its data. The flaw is classified as CWE-926 (improper export of Android application components) and carries a CVSS 4.0 score of 8.5 (high), though exploitation requires the local attack vector (a malicious app already on the device). No public proof of concept is known, the issue is not in CISA's KEV catalog, and there is no indication of exploitation in the wild.

What to do: Check Android device inventories for the Ekia File Manager app (package com.ekia.filecontrolmanager) at version 1.2.7 and update to a patched release as soon as the vendor ships one, or uninstall the app if no fix is available. Because exploitation requires a malicious app already installed locally, standard controls such as restricting installs to trusted app stores and enterprise mobile threat detection substantially reduce risk. Developers should fix this by removing the exported flag from the provider or enforcing android:permission/readPermission/writePermission and validating resolved paths stay within expected directories.