CVE-2026-40000: ZTE File Manager Path Traversal Flaw

CVE-2026-40000 Overview

CVE-2026-40000 is a path traversal vulnerability [CWE-22] in the ZTE File Manager application. The affected component is the zte.com.cn.filer/zte.com.cn.filer.FilePreViewActivity Activity, which is designed to preview compressed files. Third-party applications can launch this Activity and supply arbitrary file paths using URIs such as content://zte.com.cn.filer.fileprovider/root_path. This lets attacker-controlled apps read files at the privilege level of ZTE File Manager on unrooted devices, including content under /data/data and /data/local/tmp.

Critical Impact
Local applications on affected ZTE devices can read sensitive files in protected system directories without root, leveraging File Manager privileges.

Affected Products

ZTE File Manager (zte.com.cn.filer package)
ZTE Android-based devices shipping the File Manager application
Vulnerable component: FilePreViewActivity and zte.com.cn.filer.fileprovider

Discovery Timeline

2026-07-27 - CVE-2026-40000 published to NVD
2026-07-28 - Last updated in NVD database

Technical Details for CVE-2026-40000

Vulnerability Analysis

The ZTE File Manager exports FilePreViewActivity for previewing compressed files. The Activity accepts a file path parameter from the calling Intent without adequately validating the target. Because the File Manager runs with elevated file-access privileges relative to third-party apps, this path acceptance amounts to a confused-deputy condition.

Attackers construct an Intent that supplies a content:// URI referencing the app's own FileProvider root, such as content://zte.com.cn.filer.fileprovider/root_path. The Activity resolves the URI and reads the file on behalf of the caller. This exposes data in directories that unrooted third-party apps normally cannot access, including /data/data and /data/local/tmp.

The attack requires local application installation and user interaction, and the CVSS vector reflects physical access with high complexity, limiting practical exploitation. The impact is confidentiality-only; no integrity or availability effects are documented.

Root Cause

The root cause is improper limitation of a pathname to a restricted directory [CWE-22]. The exported Activity trusts caller-supplied paths and the FileProvider root_path mapping exposes broader filesystem areas than the preview feature requires.

Attack Vector

A malicious app installed on the device invokes FilePreViewActivity with a crafted Intent whose data URI points to a sensitive file path through the exposed FileProvider. When the preview is rendered, the file content is disclosed to the attacker-controlled context. No permissions beyond those needed to send Intents are required.

Detection Methods for CVE-2026-40000

Indicators of Compromise

Third-party applications issuing Intents targeting zte.com.cn.filer/zte.com.cn.filer.FilePreViewActivity.
Access requests to content://zte.com.cn.filer.fileprovider/root_path originating from non-ZTE packages.
File reads from /data/data/<package> or /data/local/tmp correlated with File Manager activity.

Detection Strategies

Inspect installed apps for Intents referencing the zte.com.cn.filer package and the FilePreViewActivity component.
Use MDM or EMM telemetry to flag apps that query zte.com.cn.filer.fileprovider content URIs.
Review File Manager logs for preview requests with paths outside standard user storage.

Monitoring Recommendations

Monitor mobile endpoint telemetry for unusual cross-app Intent activity targeting ZTE system apps.
Alert on installations of unknown apps that declare Intent filters or code paths interacting with zte.com.cn.filer.
Track ZTE security bulletins for updated File Manager releases addressing this CVE.

How to Mitigate CVE-2026-40000

Immediate Actions Required

Update ZTE File Manager to the version identified in the ZTE Security Bulletin once available for the device model.
Restrict installation of untrusted applications from outside vetted app stores on affected ZTE devices.
Enforce mobile application vetting policies through enterprise mobility management for corporate-owned or BYOD ZTE devices.

Patch Information

Refer to the ZTE Security Bulletin for the fixed File Manager version and rollout status per device model. Apply vendor updates through the standard OTA channel.

Workarounds

Disable or uninstall the ZTE File Manager where operationally acceptable until patched.
Prevent side-loading of unknown applications by disabling installation from unknown sources.
Use enterprise policy to block or uninstall apps that request Intents against zte.com.cn.filer components.

bash

# Configuration example: query and disable the ZTE File Manager package via ADB
adb shell pm list packages | grep zte.com.cn.filer
adb shell pm disable-user --user 0 zte.com.cn.filer