CyberRota Analysis
AI-GeneratedThe file_picker plugin for Flutter, specifically in its Android implementation up to version 10.3.10, is vulnerable to path traversal due to improper handling of file paths in the openFileStream() method. This flaw allows a malicious app to exploit the vulnerability by returning a crafted filename that includes ../ sequences, potentially leading to the creation of arbitrary files and directories outside the intended cache directory. Developers using this plugin in their Android applications should prioritize addressing this vulnerability to prevent unauthorized file access and potential data leakage.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
file_picker (aka flutter_file_picker) for Flutter, all versions through 10.3.10, is vulnerable to path traversal (CWE-22) in its Android implementation. The openFileStream() method in FileUtils.kt uses the DISPLAY_NAME obtained from ContentResolver.query() directly in file path construction without sanitization. A malicious Android app with a crafted ContentProvider can return a filename containing ../ sequences, causing the plugin to create arbitrary files and directories outside the intended cache directory within the victim app's internal storage. Existing files are not overwritten due to an existence check.