{"id":"CVE-2026-38093","details":"file_picker (aka flutter_file_picker) for Flutter, all versions through 10.3.10, is vulnerable to path traversal (CWE-22) in its Android implementation. The openFileStream() method in FileUtils.kt uses the DISPLAY_NAME obtained from ContentResolver.query() directly in file path construction without sanitization. A malicious Android app with a crafted ContentProvider can return a filename containing ../ sequences, causing the plugin to create arbitrary files and directories outside the intended cache directory within the victim app's internal storage. Existing files are not overwritten due to an existence check.","modified":"2026-08-30T03:46:16.211394792Z","published":"2026-08-28T00:00:00Z","database_specific":{"cna_assigner":"mitre","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/38xxx/CVE-2026-38093.json"},"references":[{"type":"WEB","url":"https://pub.dev/packages/file_picker"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/38xxx/CVE-2026-38093.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-38093"},{"type":"REPORT","url":"https://github.com/miguelpruivo/flutter_file_picker/issues/1967"},{"type":"PACKAGE","url":"https://github.com/miguelpruivo/flutter_file_picker"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/miguelpruivo/flutter_file_picker","events":[{"introduced":"0"},{"fixed":"97e4c8d904be181fc4cf8adc73d1ec889db0f287"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"10.3.10"}],"source":"DESCRIPTION"}}],"versions":["v10.3.8","v10.3.7","v10.3.6","v10.3.3","v10.3.2","v10.3.0","10.1.0","10.0.0","9.2.3","9.2.2","9.2.1","9.2.0","9.1.0","9.0.3","9.0.2","9.0.1","9.0.0","8.3.7","8.3.6","8.3.5","8.3.4","8.3.3","8.3.2","8.3.1","8.3.0","8.2.0","8.1.4","8.1.3","8.1.2","8.1.1","8.1.0","8.0.7","8.0.6","8.0.5","8.0.4","8.0.3","8.0.2","8.0.1","8.0.0","7.1.0","5.3.2","5.3.1","5.3.0","5.2.11","5.2.10","5.2.9","5.2.8","5.2.7","5.1.0","4.5.0","4.4.0","4.3.3","4.3.2","4.3.1","4.3.0","4.2.8","4.2.7","4.2.6","4.2.5","4.2.2","4.2.1","4.2.0","4.1.0","4.0.3","4.0.2","4.0.1","4.0.0","3.0.3","3.0.2","3.0.1","2.1.3","2.1.0","web-1.0.2","web-1.0.1","interface-1.3.1","io-1.13.0","io-1.12.0","io-1.11.0","interface-1.2.0","1.9.0","1.8.0","1.7.0","1.6.1","1.6.0","1.5.0+1","1.5.0","v1.4.3","v1.4.2","v1.4.0","v1.3.8","v1.3.5","v1.3.4+1","v1.3.4","v1.3.0","v1.2.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-38093.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"}]}