Andrés Ramos

**Name of the Vulnerable Software and Affected Versions** Secure Folder version 1.2 **Description** Files selected for the password-protected vault are stored as unencrypted files within the Android shared-storage tree. This allows a local application or file manager with access to the shared-storage path to enumerate, copy, and open these files without authenticating to the application. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Root Browser Classic version 3.3.0 **Description** Root Browser Classic passes the path of a selected SQLite database to an operating-system shell without safely separating the filename from the command. This lack of separation can allow for command injection, where an attacker could execute arbitrary commands on the system by manipulating the database path. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** The product name cannot be determined (affected versions not specified) **Description** The application uses a calculator-style vault passcode to protect access, but the stored data is not bound to this authentication boundary. A local actor with access to shared external storage, such as through an authorized non-root ADB shell or another local file-reading context with appropriate storage access, can bypass the passcode by copying the SQLite database and media files directly. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Ekia File Manager version 1.2.7 **Description** The application exposes `com.ekia.filecontrolmanager.OpenFileProvider` as an exported Android ContentProvider without requiring caller permissions. The provider maps a caller-controlled URI path directly to a filesystem path and passes it to the `new File(...)` function. It supports `query()`, `openFile()`, and `delete()` operations. Since the provider lacks `android:permission`, `android:readPermission`, or `android:writePermission`, a local application can access the provider authority to read, create, overwrite, or delete files accessible to the File Manager process. **Recommendations** Update Ekia File Manager to a version newer than 1.2.7. As a temporary mitigation, restrict access to the `com.ekia.filecontrolmanager.OpenFileProvider` component.

**Name of the Vulnerable Software and Affected Versions** Gallery - Private Photo Vault version 1.0.41 **Description** The application starts an unauthenticated HTTP server accessible from the local network. This server listens on TCP port 8080 and allows the retrieval of files and directory listings from the Android external storage. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.