CVE-2026-38093 in file_picker Plugin
Summary
by MITRE • 08/28/2026
file_picker (aka flutter_file_picker) for Flutter, all versions through 10.3.10, is vulnerable to path traversal (CWE-22) in its Android implementation. The openFileStream() method in FileUtils.kt uses the DISPLAY_NAME obtained from ContentResolver.query() directly in file path construction without sanitization. A malicious Android app with a crafted ContentProvider can return a filename containing ../ sequences, causing the plugin to create arbitrary files and directories outside the intended cache directory within the victim app's internal storage. Existing files are not overwritten due to an existence check.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/28/2026
The file_picker library for Flutter, specifically versions up through 10.3.10, contains a critical path traversal vulnerability in its Android implementation that allows attackers to write arbitrary files and directories outside the intended application cache directory. This flaw stems from improper input validation within the openFileStream method located in FileUtils.kt. The core issue arises because the library retrieves file metadata via ContentResolver.query() and directly utilizes the DISPLAY_NAME field returned by this query for constructing local file paths without performing any sanitization or normalization checks. In Android development, when an application requests a user to select a file through a system picker or custom intent, the resulting Uri is resolved using ContentResolver methods which may return display names provided by third-party content providers rather than strictly controlled filenames from the local filesystem.
This vulnerability aligns with CWE-22, Improper Limitation of a Pathname to a Restricted Directory, as the application fails to restrict file operations within expected boundaries. The operational impact is significant because it enables an attacker who can control or influence the ContentProvider serving files through this plugin to dictate where data is written on the victim device's internal storage. By crafting a malicious Android app that acts as a content provider and returns filenames containing directory traversal sequences such as ../, an adversary can manipulate the path construction logic in file_picker. Consequently, instead of saving temporary or cached files strictly within the designated cache folder, the application creates new directories and writes data to arbitrary locations relative to the victim app's internal storage root. This capability effectively bypasses standard sandboxing protections that rely on directory isolation for security boundaries between applications.
The severity of this vulnerability is somewhat mitigated by a specific implementation detail regarding file overwriting behavior. The library includes an existence check before creating files, which prevents existing files from being overwritten with malicious content. While this restriction limits the ability to directly replace critical system or application binaries, it does not eliminate the risk entirely. An attacker can still create new directories and inject arbitrary data into previously non-existent paths within the internal storage space allocated to the victim app. This capability facilitates potential information disclosure if combined with other vulnerabilities that allow reading these newly created files, or it may be used for denial of service by filling up disk space in specific locations. Furthermore, depending on how the application subsequently processes these files, such as passing them to other components without further validation, this could lead to secondary issues like local file inclusion or command injection if the paths are interpreted by underlying system commands.
From a threat modeling perspective using MITRE ATT&CK frameworks, this vulnerability supports techniques related to Collection and Exfiltration over Local Networks, specifically leveraging stored data for subsequent exploitation phases. It also relates to Defense Evasion through Obfuscated Files or Information, as attackers can hide malicious artifacts in unexpected directories within the app's private storage area where standard security monitoring tools might not look by default. To mitigate this risk, developers should immediately upgrade file_picker to a version that addresses this flaw, ensuring that path construction logic properly normalizes and validates all inputs derived from external sources like ContentResolver queries. Best practices dictate implementing strict allow-listing for allowed characters in filenames and using canonicalization functions such as getCanonicalPath() before performing any filesystem operations. Additionally, applications should enforce directory restrictions by verifying that the final resolved file path remains within the expected cache or data directories after normalization, rejecting any requests where traversal sequences result in paths escaping these boundaries.