CVE-2026-38093

Name of the Vulnerable Software and Affected Versions file picker versions prior to 10.3.11

Description The Android implementation of the plugin contains a path traversal issue. The openFileStream() function in FileUtils.kt uses the DISPLAY NAME obtained from ContentResolver.query() to construct file paths without proper sanitization. A malicious Android application using a crafted ContentProvider can return a filename containing ../ sequences, allowing the plugin to create arbitrary files and directories outside the intended cache directory within the victim application's internal storage. This process does not overwrite existing files due to an internal existence check.

Recommendations Update to version 10.3.11 or later.