Description

file_picker (aka flutter_file_picker) for Flutter, all versions through 10.3.10, is vulnerable to path traversal (CWE-22) in its Android implementation. The openFileStream() method in FileUtils.kt uses the DISPLAY_NAME obtained from ContentResolver.query() directly in file path construction without sanitization. A malicious Android app with a crafted ContentProvider can return a filename containing ../ sequences, causing the plugin to create arbitrary files and directories outside the intended cache directory within the victim app's internal storage. Existing files are not overwritten due to an existence check.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.3",
  "pubDate": "2026-08-28T16:17:46.793Z",
  "pubdate": "2026-08-28T16:17:46.793Z",
  "executiveSummary": "The flutter_file_picker library (all versions through 10.3.10) is susceptible to a path traversal vulnerability (CWE-22) affecting its Android implementation. This flaw arises from the insecure handling of filenames returned by the ContentResolver during file operations.\nA malicious application providing a crafted ContentProvider can supply a filename containing directory traversal sequences (e.g., ../). When the plugin processes this file, it fails to sanitize the input, allowing the construction of file paths outside the designated cache directory.\nThe impact includes the creation of arbitrary files and directories within the victim application's internal storage, potentially disrupting app functionality or facilitating unauthorized data placement. While the vulnerability does not facilitate the overwriting of existing files due to a pre-check mechanism, it represents a significant security oversight regarding input validation. The attack requires the presence of a malicious ContentProvider on the device capable of interacting with the vulnerable plugin. Exploitation is localized to the internal storage context of the victim app, presenting a risk to data integrity and application-level isolation.",
  "technicalDetails": "The vulnerability is located in the openFileStream() method within the FileUtils.kt file of the flutter_file_picker Android implementation. The root cause is the direct utilization of the DISPLAY_NAME column retrieved via ContentResolver.query() when constructing the destination path for file operations.\nIn the Android framework, the DISPLAY_NAME associated with a Content URI is determined by the providing application. A malicious app acting as a ContentProvider can return a string value containing traversal characters such as '../'. When the plugin receives this value, it concatenates it with the target internal storage directory path without performing any canonicalization or validation checks.\nThe attack flow proceeds as follows: First, a malicious Android application registers a ContentProvider that serves a file with a maliciously crafted name. Second, the victim application, utilizing a vulnerable version of flutter_file_picker, triggers a file picker or stream retrieval operation. Third, the plugin queries the malicious ContentProvider for file metadata, receiving the crafted DISPLAY_NAME. Fourth, the plugin uses this unsanitized name to define the file path in the application's internal storage directory. Finally, the file stream is written to the system, resulting in the creation of a file or directory at a location unintended by the developer.\nBecause the plugin lacks path normalization, the '..' sequences instruct the underlying filesystem to traverse up the directory structure relative to the intended base path. While the vulnerability is limited by an existence check that prevents overwriting existing files, an attacker can still create new files or empty directory structures in unauthorized locations within the sandbox. This behavior bypasses the expected isolation boundaries of the app's cache storage. The vulnerability affects all versions of flutter_file_picker through 10.3.10 and does not require authentication from the victim app, as it relies on standard inter-app communication patterns provided by the Android OS. No network exposure is necessary for exploitation, as the interaction occurs entirely on the local device between the malicious provider and the vulnerable plugin."
}