The vulnerability is a path traversal flaw in the Android implementation of the file_picker plugin. The openFileStream() method uses the DISPLAY_NAME from ContentResolver.query() directly in file path construction without sanitization. A malicious Android app can supply a crafted ContentProvider that returns a filename containing '../' sequences, enabling the plugin to create files and directories outside the intended cache directory inside the victim app’s internal storage. Existing files are not overwritten because an existence check is performed, but the flaw still allows placement of arbitrary files outside the allowed location.

Flutter applications that use the flutter_file_picker plugin, versions through 10.3.10.

The CVSS score of 3.3 indicates low severity, and the EPSS score is not available. The vulnerability is not listed in the CISA KEV catalog. An attacker needs a malicious Android app that supplies a custom ContentProvider, and the exploit is local to the device running the victim app. Because the flaw allows the creation of files in the victim app’s internal storage, it could be used to modify data, elevate privileges, or facilitate other attacks if the created files are later processed by the app. This conclusion is inferred from the description of the vulnerability and its impact; the exact extent of operational risk depends on how the victim app uses the files it receives.