## https://sploitus.com/exploit?id=53BECBB1-A292-5E38-986E-E52ECFF87EC7
# CVE-2026-40000
A poc for [CVE-2026-40000](https://vulners.com/cve/CVE-2026-40000), a vulnerability in ZTE File Manager (zte.com.cn.filer) which allows to read arbitrary files from other apps as the privileges of this file manager
How to: build the project (or get the app from [releases](https://github.com/Skorpion96/CVE-2026-40000/releases)), install and open the poc, then input a file to open and press the button ```Open as zte.com.cn.filer``` to try to open it. On the ZTE File Manager select ```extract all```, then confirm the decompression, it will fail and prompt you to choose an external app to open it (you will be allowed to choose from android open picker). The ZTE File Manager will copy the file to ```/sdcard/Android/data/zte.com.cn.filer/cache``` and decompress it on a temp subdir. When you will try to open a file with the name of one in system PATH (or directly one in system PATH) it will be copied directly to ```/sdcard/Android/data/zte.com.cn.filer/cache``` and the app will ask if you want to overwrite it.
How the poc works: it does something like ```adb shell am start -d content://zte.com.cn.filer.fileprovider/root_path/filetoopen zte.com.cn.filer/zte.com.cn.filer.FilePreViewActivity```
The app has this provider
```
```
Even if not exported it can be called by this activity
```
android:name="zte.com.cn.filer.FilePreViewActivity"
android:exported="true"
```
Since we are calling the provider from one of it's own app activities the exported thing becomes useless. The activity is exported to true so can be called from other components.
Obviously this is not enough, the app needs to allow access to ```/``` or at least sensitive paths. Turns out it does ```(from android:resource="@xml/provider_paths)```, even tough it uses a ```.``` it points to ```/``` allowing to open files from anywhere the files app has access
```
```