CVE-2026-38093: Flutter File Picker Path Traversal Flaw

CVE-2026-38093 Overview

CVE-2026-38093 is a path traversal vulnerability [CWE-22] in the file_picker (also known as flutter_file_picker) plugin for Flutter, affecting all versions through 10.3.10. The flaw resides in the Android implementation, where the openFileStream() method in FileUtils.kt incorporates the DISPLAY_NAME returned by ContentResolver.query() into a file path without sanitization. A malicious Android application exposing a crafted ContentProvider can return filenames containing ../ sequences. This causes the victim app to create arbitrary files and directories outside the intended cache directory within its internal storage sandbox.

Critical Impact
A malicious local Android app can force a victim application using file_picker to write files into arbitrary locations within the victim's internal storage, though existing files are not overwritten.

Affected Products

file_picker (aka flutter_file_picker) Flutter plugin, all versions through 10.3.10
Android builds of Flutter applications embedding the vulnerable plugin
file_picker package distributed via pub.dev

Discovery Timeline

2026-08-28 - CVE-2026-38093 published to NVD
2026-08-28 - Last updated in NVD database

Technical Details for CVE-2026-38093

Vulnerability Analysis

The vulnerability lives in the Android-native portion of the file_picker plugin. When a user selects a file through a system picker, Android returns a content URI. The plugin resolves metadata for that URI by calling ContentResolver.query() and reading the DISPLAY_NAME column. The plugin then uses this string directly to construct a destination path inside the app's cache directory to stage the file.

Because the DISPLAY_NAME value is attacker-controlled when the URI is served by a malicious ContentProvider, the plugin can be coerced into writing outside its cache directory. The attacker must have code running locally on the same device, which limits the attack surface to co-located malicious apps abusing the picker workflow.

An existence check prevents overwriting files that already exist. However, the attacker can still create new files and directories at arbitrary paths within the victim application's internal storage, enabling planting of configuration, data, or side-channel artifacts that the victim app may later trust.

Root Cause

The root cause is missing input sanitization on filesystem-relevant metadata. The DISPLAY_NAME field returned by a ContentProvider is untrusted data. The plugin concatenates this value into a path passed to file I/O routines without stripping directory separators or resolving .. traversal segments against a canonical base directory.

Attack Vector

Exploitation requires a malicious Android application installed on the same device as the victim app. The attacker app registers a ContentProvider that responds to ContentResolver.query() with a DISPLAY_NAME value such as ../../files/config.json. When the victim app invokes the file picker and the user selects the attacker-provided document, the vulnerable plugin builds a destination path that escapes the cache directory. The plugin then writes the file contents to the traversed location inside the victim's private storage sandbox. See the GitHub Issue #1967 on Flutter File Picker for technical details.

No verified proof-of-concept code is published. See the linked GitHub issue for reproduction details.

Detection Methods for CVE-2026-38093

Indicators of Compromise

Unexpected files or subdirectories created outside the cache directory in an app's internal storage, such as under files/, shared_prefs/, or databases/.
Filenames containing ../ sequences or path separators observed in application logs referencing file_picker operations.
Installed third-party apps that export a ContentProvider returning unusual DISPLAY_NAME values with directory traversal characters.

Detection Strategies

Inspect Flutter applications for the file_picker dependency and verify the resolved version against the vulnerable range (through 10.3.10) in pubspec.lock.
Perform static analysis of FileUtils.kt usage to identify code paths that consume DISPLAY_NAME without sanitization.
During QA, fuzz the picker flow using a test ContentProvider that returns filenames containing .., forward slashes, and null bytes, then verify destination paths remain inside the intended cache directory.

Monitoring Recommendations

Enable mobile application management telemetry to flag apps writing to unexpected internal storage locations after file picker interactions.
Track dependency inventories in CI pipelines and alert when Flutter builds ship with file_picker versions at or below 10.3.10.
Monitor Android crash and logcat traces for IOException events referencing traversal-style paths originating from file_picker.

How to Mitigate CVE-2026-38093

Immediate Actions Required

Identify all Flutter applications in your portfolio that depend on file_picker or flutter_file_picker and audit their resolved versions.
Upgrade the plugin to a fixed release tracked in GitHub Issue #1967 on Flutter File Picker once available, then rebuild and republish affected Android artifacts.
Where an upstream patch is not yet available, apply a local override that sanitizes DISPLAY_NAME before path construction in FileUtils.kt.

Patch Information

At publication time, remediation status is tracked through the upstream project. Refer to the GitHub Repository for Flutter File Picker and the Pub.dev Package: File Picker for the latest patched release. Applications must upgrade past version 10.3.10 once the fixed release is published and pinned in pubspec.yaml.

Workarounds

Sanitize the DISPLAY_NAME before use by stripping path separators and rejecting values containing .. segments.
Canonicalize the destination path with File.getCanonicalPath() and verify it resides beneath the app's cache directory before writing.
Limit accepted content URIs to trusted providers where feasible, and prompt users to avoid selecting files exposed by unknown third-party apps.

bash

# Example dependency pin in pubspec.yaml once a fixed release is available
# Replace <FIXED_VERSION> with the vendor-published patched version
dependencies:
  file_picker: ^<FIXED_VERSION>