Git · Flutter File Picker · CVE-2026-38093
**Name of the Vulnerable Software and Affected Versions**
file picker versions prior to 10.3.11
**Description**
The Android implementation of the plugin contains a path traversal issue. The `openFileStream()` function in `FileUtils.kt` uses the `DISPLAY NAME` obtained from `ContentResolver.query()` to construct file paths without proper sanitization. A malicious Android application using a crafted ContentProvider can return a filename containing `../` sequences, allowing the plugin to create arbitrary files and directories outside the intended cache directory within the victim application's internal storage. This process does not overwrite existing files due to an internal existence check.
**Recommendations**
Update to version 10.3.11 or later.