CVE-2026-0035
published 2026-03-02CVE-2026-0035: In createRequest of MediaProvider.java, there is a possible way for an app to gain read/write access to non-existing files due to a logic error in the code…
PriorityP345high8.4CVSS 3.1
AVLACLPRNUINSUCHIHAH
EPSS
0.10%
1.2th percentile
In createRequest of MediaProvider.java, there is a possible way for an app to gain read/write access to non-existing files due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Affected
14 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| github.com | filebrowser_filebrowser | 0 – 1.11.0 | — |
| github.com | filebrowser_filebrowser_v2 | >= 0 < 2.63.7 | 2.63.7 |
| android | — | — | |
| android | — | — | |
| android | — | — | |
| android | — | — | |
| android | — | — | |
| android | — | — | |
| android | — | — | |
| platform | packages_providers_mediaprovider | >= 14:0 < 14:2026-03-01 | 14:2026-03-01 |
| platform | packages_providers_mediaprovider | >= 15:0 < 15:2026-03-01 | 15:2026-03-01 |
| platform | packages_providers_mediaprovider | >= 16-qpr2-next:0 < 16-qpr2-next:2026-03-01 | 16-qpr2-next:2026-03-01 |
| platform | packages_providers_mediaprovider | >= 16-qpr2:0 < 16-qpr2:2026-03-01 | 16-qpr2:2026-03-01 |
| platform | packages_providers_mediaprovider | >= 16:0 < 16:2026-03-01 | 16:2026-03-01 |
CVSS provenance
nvdv3.18.4HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
ghsa8.4HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
File Browser: Improper Access Control Occurs via Pre-Created Public Share for a Non-existent Path
ghsa·2026-06-12·CVSS 8.4
CVE-2026-54096 [HIGH] CWE-367 File Browser: Improper Access Control Occurs via Pre-Created Public Share for a Non-existent Path
File Browser: Improper Access Control Occurs via Pre-Created Public Share for a Non-existent Path
### Summary
This is similar vulnrability of **`CVE-2026-0035`**, which was fixed in Android `MediaProvider` with **high** severity. In the original Java issue, `MediaStore.createWriteRequest()` accepted attacker-controlled URIs and created a future grant even when the referenced media item did not exist yet. The Android fix added an existence check before creating the request.
`filebrowser/filebrowser` has the analogous issue in Go. `POST /api/share/` accepts an authenticated request for an arbitrary path and stores a public share record without checking whether the target file currently exists. Later, when a file is created at that same path, the previously created public share immediately
GHSA
GHSA-qq79-ch56-mqvf: In createRequest of MediaProvider
ghsa_unreviewed·2026-03-02
CVE-2026-0035 [HIGH] CWE-125 GHSA-qq79-ch56-mqvf: In createRequest of MediaProvider
In createRequest of MediaProvider.java, there is a possible way for an app to gain read/write access to non-existing files due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
OSV
CVE-2026-0035: In createRequest of MediaProvider
osv·2026-03-01
CVE-2026-0035 CVE-2026-0035: In createRequest of MediaProvider
In createRequest of MediaProvider.java, there is a possible way for an app to gain read/write access to non-existing files due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
No detection rules found.
No public exploits indexed.
2026-03-02
Published