CVE-2026-81301 Overview
CVE-2026-81301 affects Ekia File Manager 1.2.7 on Android. The application exports the com.ekia.filecontrolmanager.OpenFileProvider ContentProvider without declaring android:permission, android:readPermission, or android:writePermission. Any locally installed app can query the provider authority and coerce File Manager's process into reading, creating, overwriting, or deleting files reachable by that process. The issue is classified under CWE-926: Improper Export of Android Components.
Critical Impact
A local unprivileged Android application can read and destroy arbitrary files accessible to File Manager without user interaction or granted permissions.
Affected Products
- Ekia File Manager version 1.2.7 for Android
- The com.ekia.filecontrolmanager.OpenFileProvider component
- Distribution package com.ekia.files.manager on Google Play
Discovery Timeline
- 2026-09-14 - CVE-2026-81301 published to the National Vulnerability Database
- 2026-09-18 - Last updated in NVD database
- Advisory published by Fluid Attacks: Fluid Attacks Security Advisory
Technical Details for CVE-2026-81301
Vulnerability Analysis
Ekia File Manager 1.2.7 registers OpenFileProvider as an exported Android ContentProvider. Exported providers are reachable by any app installed on the device unless access is gated by a signature or runtime permission. The manifest declaration for this provider omits all three permission attributes, so the Android platform performs no caller checks before dispatching requests.
The provider implements query(), openFile(), and delete() methods. Each method takes the incoming Uri, extracts the path segment, and passes it directly to new File(...). There is no canonicalization, no allowlist of directories, and no verification that the requested path resides inside the application's private storage.
A malicious local application can craft a URI targeting arbitrary filesystem locations reachable by the File Manager process. Because the operation runs under the File Manager UID, it can touch any file that UID owns or has been granted access to, including cached user data, shared external storage, and files exposed through granted media permissions.
Root Cause
The root cause is improper export of an Android component combined with missing input validation on caller-controlled URI paths. The manifest exposes the provider to third-party callers, and the implementation trusts the caller to supply a safe path.
Attack Vector
Exploitation requires only that an attacker-controlled application be installed on the same device. The attacker calls ContentResolver.query(), openFile(), or delete() against the provider's authority with a URI whose path segment references the target file. No user interaction, granted permissions, or elevated privileges are required.
No verified proof-of-concept code is published in the enriched dataset. Refer to the Fluid Attacks advisory for reproduction details.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-81301
Indicators of Compromise
- Unexpected deletion, truncation, or modification of files inside Ekia File Manager's data directory or accessible shared storage paths
- Presence of installed third-party apps that resolve or bind to the com.ekia.filecontrolmanager.OpenFileProvider authority
- Logcat entries showing ContentResolver calls to the provider authority originating from UIDs other than File Manager
Detection Strategies
- Enumerate installed applications and inspect their manifests for <uses-permission> or <queries> entries referencing the affected provider authority
- Use Android's dumpsys package and pm dump to confirm the provider is exported with no permission attributes
- Run static analysis on APKs (for example with apktool or MobSF) to flag exported providers that lack permission gating
Monitoring Recommendations
- Monitor mobile device management (MDM) telemetry for installations of Ekia File Manager version 1.2.7
- Alert on file integrity changes within directories owned by the File Manager package on managed Android devices
- Track new app installations on enterprise-managed devices where Ekia File Manager is present
How to Mitigate CVE-2026-81301
Immediate Actions Required
- Uninstall Ekia File Manager 1.2.7 from managed Android devices until a patched release is confirmed
- Restrict Google Play installation of com.ekia.files.manager through MDM app allowlists
- Audit devices for other apps that may already be abusing the exported provider
Patch Information
No vendor patch is listed in the enriched CVE data at the time of publication. Monitor the Google Play listing for Ekia File Manager and the Fluid Attacks advisory for a fixed release. A proper fix requires the vendor to set android:exported="false" on the provider, or add a signature-level android:permission, and to canonicalize and validate all caller-supplied URI paths against an allowlist.
Workarounds
- Remove the application from sensitive devices; there is no user-side configuration that disables the exported provider
- Replace Ekia File Manager with a file manager that scopes access through the Storage Access Framework and does not expose unguarded providers
- On enterprise fleets, enforce a work profile that isolates file access and blocks installation of unvetted file management apps
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
