CVE-2026-40000

A poc for CVE-2026-40000, a vulnerability in ZTE File Manager (zte.com.cn.filer) which allows to read arbitrary files from other apps as the privileges of this file manager

How to: build the project (or get the app from releases), install and open the poc, then input a file to open and press the button Open as zte.com.cn.filer to try to open it. On the ZTE File Manager select extract all, then confirm the decompression, it will fail and prompt you to choose an external app to open it (you will be allowed to choose from android open picker). The ZTE File Manager will copy the file to /sdcard/Android/data/zte.com.cn.filer/cache and decompress it on a temp subdir. When you will try to open a file with the name of one in system PATH (or directly one in system PATH) it will be copied directly to /sdcard/Android/data/zte.com.cn.filer/cache and the app will ask if you want to overwrite it. There is also a way to recognize immediately if the to be opened file can or cannot be accessed by the ZTE File Manager (assuming the app doesn't have permissions to read it): on the FilePreViewActivity up left corner and also up where there is the back arrow when it's possible to open the file it's shown the file name, instead when the open fails no name shows up.

How the poc works: it does something like adb shell am start -d content://zte.com.cn.filer.fileprovider/root_path/filetoopen zte.com.cn.filer/zte.com.cn.filer.FilePreViewActivity

The app has this provider

   <provider
            android:name="androidx.core.content.FileProvider"
            android:exported="false"
            android:authorities="zte.com.cn.filer.fileprovider"
            android:grantUriPermissions="true">
            <meta-data
                android:name="android.support.FILE_PROVIDER_PATHS"
                android:resource="@xml/provider_paths"/>
  </provider>

Even if not exported it can be called by this activity

android:name="zte.com.cn.filer.FilePreViewActivity" 
android:exported="true"

Since we are calling the provider from one of it's own app activities the exported thing becomes useless. The activity is exported to true so can be called from other components.

Obviously this is not enough, the app needs to allow access to / or at least sensitive paths. Turns out it does (from android:resource="@xml/provider_paths), even tough it uses a . it points to / allowing to open files from anywhere the files app has access

<?xml version="1.0" encoding="utf-8"?>
<paths xmlns:android="http://schemas.android.com/apk/res/android">
    <files-path
        name="files-path"
        path="."/>
    <external-path
        name="external_files"
        path="."/>
    <root-path
        name="root_path"
        path="."/>
    <external-cache-path
        name="external_cache_path"
        path="."/>
</paths>

Devices affected: ZTE Blade A75 5G and new models probably unless updated (i don't have them so i'm guessing). On android 9 up to 12 (probably on earlier Android versions the situation is the same) the app is missing the zte.com.cn.filer.FilePreViewActivity so it's not vulnerable seems or could happen the app is completely absent (stock google filer is used at least where i tried).

I'm not responsible for misuse of this, the vulnerability is local, got CVE and so is patched. Do system updates or upgrade your device to a newer one in case you are worried.