CVE-2024-54461
High
Description
The file names constructed within file_selector are missing sanitization checks leaving them vulnerable to malicious document providers. This may result in cases where a user with a malicious document provider installed can select a document file from that provider while using your app and could potentially override internal files in your app cache. Issue patched in 0.5.1+12. It is recommended to update to the latest version of file_selector_android that contains the changes to address this vulnerability.
SeverityHigh
CVSS7.1
Exploit probability—
Product
Flutter File Selector Android
PublishedJan 29, 2025
First seenJan 29, 2025
Weakness typeCWE-23CWE-23
How to fix
Update
- flutter file_selector_android0.5.1\+12 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| flutter file_selector_android | 0.5.1 ≤ v < 0.5.1\+12 | 0.5.1\+12 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.