CVE-2024-54462
High
Description
The file names constructed within image_picker are missing sanitization checks leaving them vulnerable to malicious document providers. This may result in cases where a user with a malicious document provider installed can select an image file from that provider while using your app and could potentially override internal files in your app cache. Issue patched in 0.8.12+18. It is recommended to update to the latest version of image_picker_android that contains the changes to address this vulnerability.
SeverityHigh
CVSS7.1
Exploit probability—
Product
Flutter Image Picker Android
PublishedJan 29, 2025
First seenJan 29, 2025
Weakness typeCWE-23CWE-23
How to fix
Update
- flutter image_picker_android0.8.12\+18 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| flutter image_picker_android | 0.8.5\+6 ≤ v < 0.8.12\+18 | 0.8.12\+18 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.