CVE-2026-107018 Details
Description
Insecure permissions in Ghost Commander File Manager versionCode 479 allows unauthorized attackers to arbitrarily read and write files inside the commander's private storage.
A vulnerability in Ghost Commander File Manager, specifically in version 479, has been identified that allows unauthorized access to files within the application's private storage. This issue arises from insecure permissions that enable attackers to read and write files arbitrarily. The vulnerability is rooted in the application's exported StreamProvider, which accepts caller-decoded file URIs without proper permission controls, thereby exposing private storage to potential exploitation.
As of now, no fix has been released for this vulnerability. However, it is recommended to add a permission requirement to the affected StreamProvider component or to set it as not exported, ensuring that only the vendor's own applications can access it.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 29, 2026CISA-ADP
Assessed Nov 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107018.md | CISA-ADP | AdvisoryExploitRemedy |
| https://f-droid.org/packages/com.ghostsq.commander/ | [email protected] | ProductVendor |
| https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107018.md | [email protected] | AdvisoryExploitRemedy |
| https://sourceforge.net/p/ghostcommander | [email protected] | Content WallVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-732 | Incorrect Permission Assignment for Critical Resource | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| Ghost Commander | 479 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 3, 2026 | CVE Modified | CISA-ADP |
| Oct 29, 2026 | New CVE Received | [email protected] |