The vulnerability lies in the FilePreViewActivity of the ZTE File Manager, which accepts arbitrary file paths from third‑party applications. An attacker can supply paths that point to protected system locations such as /data/data or /data/local/tmp. By exploiting this oversight, the attacker gains read access to files with the same privileges as the trusted file manager, potentially exposing sensitive data without requiring root access.

ZTE Blade A75 5G is affected. No specific firmware or software version numbers were disclosed, so all installed copies of the device are potentially vulnerable until an update is applied.

The CVSS score is 1.8, indicating low severity, and the EPSS score is < 1%. The vulnerability is not listed in KEV. The attack requires a malicious or compromised third‑party application that can launch the vulnerable activity, suggesting a local or "same‑device" threat model. While the impact is limited to file disclosure and does not enable remote code execution, the data exposure risk remains if sensitive files reside in the accessible directories.