CyberRota Analysis
AI-GeneratedThe ZTE File Manager's FilePreViewActivity is vulnerable to unauthorized file access due to its ability to accept arbitrary file paths from third-party applications. This flaw allows unrooted devices to potentially read sensitive files in system directories, which could lead to data exposure if access controls are insufficient. Organizations using ZTE devices should prioritize patching this vulnerability to mitigate risks associated with unauthorized data access.
Original NVD Description
The Activity zte.com.cn.filer/zte.com.cn.filer.FilePreViewActivity within ZTE File Manager is designed to preview compressed files. Third-party applications can launch this Activity and supply arbitrary file paths (e.g., content://zte.com.cn.filer.fileprovider/root_path), enabling file access with the privilege level of ZTE File Manager. This allows unrooted devices to read files under certain system directories such as /data/data and /data/local/tmp. If access restrictions do not block untrusted applications, additional directories may also be accessible.