CVE-2026-40000
Received Received - Intake

Path Traversal in ZTE File Manager

Publication date: 2026-07-27

Last updated on: 2026-07-27

Assigner: ZTE Corporation

Description
The Activity zte.com.cn.filer/zte.com.cn.filer.FilePreViewActivity within ZTE File Manager is designed to preview compressed files. Third-party applications can launch this Activity and supply arbitrary file paths (e.g., content://zte.com.cn.filer.fileprovider/root_path), enabling file access with the privilege level of ZTE File Manager. This allows unrooted devices to read files under certain system directories such as /data/data and /data/local/tmp. If access restrictions do not block untrusted applications, additional directories may also be accessible.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-27
Last Modified
2026-07-27
Generated
2026-07-27
AI Q&A
2026-07-27
EPSS Evaluated
N/A
NVD
CVE-2026-40000
EUVD
EUVD-2026-49136

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
zte zte_file_manager *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves the ZTE File Manager app's FilePreViewActivity component. Third-party apps can launch this activity with arbitrary file paths, gaining access to files with ZTE File Manager's privileges. This allows reading files in restricted directories like /data/data and /data/local/tmp on unrooted devices.

Detection Guidance

This vulnerability involves the ZTE File Manager's Activity allowing arbitrary file path access. Detection requires checking if ZTE File Manager is installed and inspecting its exported Activities for improper file access permissions.

Impact Analysis

An attacker could exploit this to access sensitive files on your device, such as app data or temporary files, even without root access. This could lead to data theft or privacy breaches if malicious apps are installed.

Compliance Impact

This vulnerability allows unauthorized file access on unrooted devices, potentially exposing sensitive data in directories like /data/data and /data/local/tmp. This could lead to violations of data protection regulations such as GDPR or HIPAA if personal or health-related data is accessed without proper authorization.

Mitigation Strategies

Immediately uninstall or disable ZTE File Manager. Restrict third-party app installations and monitor for unusual file access patterns. Apply app updates if a patch is released by ZTE.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-40000. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart