# CVE-2026-81301

## Summary

- **CVE ID:** CVE-2026-81301
- **Severity:** HIGH
- **CVSS Score:** 8.5 (CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N)
- **CWE:** CWE-926
- **Published:** Sep 14, 2026
- **Last Modified:** Sep 14, 2026

## Description

Ekia File Manager 1.2.7 exposes com.ekia.filecontrolmanager.OpenFileProvider as an exported Android ContentProvider without requiring caller permissions.

The provider maps the caller-controlled URI path directly to a filesystem path and passes it to new File(...). It then supports query(), openFile(), and delete() operations. Because the provider is exported and lacks android:permission, android:readPermission, or android:writePermission, another local application can access the provider authority and cause File Manager's process to read, create, overwrite, or delete files that are accessible to that process.

## Affected Products

- Ekia — File Manager (1.2.7)

## References

- [CNA](https://fluidattacks.com/advisories/waking)
- [CNA](https://play.google.com/store/apps/details?id=com.ekia.files.manager)

## Exploitation Prediction (EPSS)

- **EPSS Score:** 0.11%
- **EPSS Percentile:** 1.6

---
_Exported from OnDuty AI Vulnerability Intelligence on 2026-09-18._