CVE WatchJul 27, 2026

CVE-2026-40000

The Activity zte.com.cn.filer/zte.com.cn.filer.FilePreViewActivity within ZTE File Manager is designed to preview compressed files. Third-pa

CVSS

1.8

Low

EPSS

—

KEV

—

Exploit Today

0-100

Published: Jul 27, 2026 · Last modified: Jul 27, 2026 · CWE-22

EPSS · 30d

Not enough EPSS history yet.

Technical description

The Activity zte.com.cn.filer/zte.com.cn.filer.FilePreViewActivity within ZTE File Manager is designed to preview compressed files. Third-party applications can launch this Activity and supply arbitrary file paths (e.g., content://zte.com.cn.filer.fileprovider/root_path), enabling file access with the privilege level of ZTE File Manager. This allows unrooted devices to read files under certain system directories such as /data/data and /data/local/tmp. If access restrictions do not block untrusted applications, additional directories may also be accessible.

Official references

support.zte.com.cnhttps://support.zte.com.cn/zte-iccp-isupport-webui/bulletin/detail/7341653040963675660

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-66397—

—

———phpMyFAQ before 4.1.6 fails to validate path traversal sequences in the existing_image field during category updates, allowing authenticated attackers to delete arbitrary files by exploiting insufficient sanitization in Image::delete(). Attackers can delete the database.php configuration file to disable the installation gate and access the public setup wizard to create new superadmin accounts.6h CVE-2026-664764.9 MED

—

———Administrator Arbitrary File Deletion in Easy Digital Downloads <= 3.6.9 versions.4h CVE-2026-660507.5 HIG

—

———NitroShare Desktop through 0.3.4 contains a path traversal vulnerability in its LAN file transfer server that allows unauthenticated attackers on the same network to write arbitrary files by sending a crafted filename containing directory traversal sequences in the JSON item header name field. Attackers can exploit the lack of path validation to write files outside the transfer root directory to arbitrary locations the current user has write access, including the Windows Startup folder, enabling persistent code execution on the next user login.5h CVE-2026-654366.8 MED

—

———Editor Arbitrary File Deletion in Kirki <= 6.0.13 versions.4h CVE-2026-65878—

—

———Joomla Extension - joomshaper.com - Authenticated arbitrary file delete in SP Page Builder < 6.7.1- Improper path validation and ACL checks lead to a file deletion vector in the media manager.8h CVE-2026-175145.3 MED

—

———A vulnerability was determined in ZJONSSON node-unzipper up to 0.12.3. Affected by this vulnerability is the function Extract of the file lib/extract.js. This manipulation causes path traversal. The attack requires local access. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.7h