CVE-2026-40000
LowCVSS 1.8Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
The ZTE File Manager application contains a vulnerability that allows third-party apps to launch the FilePreViewActivity and supply arbitrary file paths. This enables reading files with the file manager's privileges, including system directories like /data/data and /data/local/tmp on unrooted devices.
Risk Assessment
An attacker can access sensitive data stored in system directories of other applications, leading to a breach of data confidentiality.
Recommendation
Update ZTE File Manager to the latest version that includes a fix restricting access to the FilePreViewActivity.
Original NVD description (English source)
The Activity zte.com.cn.filer/zte.com.cn.filer.FilePreViewActivity within ZTE File Manager is designed to preview compressed files. Third-party applications can launch this Activity and supply arbitrary file paths (e.g., content://zte.com.cn.filer.fileprovider/root_path), enabling file access with the privilege level of ZTE File Manager. This allows unrooted devices to read files under certain system directories such as /data/data and /data/local/tmp. If access restrictions do not block untrusted applications, additional directories may also be accessible.