Ghost Commander: Improper export of content provider allows file access
Ghost Commander File Manager for Android, versionCode 479, exposes an exported content provider (StreamProvider) without permission checks. A locally installed app without runtime permissions can read and write files in the app's private storage by supplying a file URI. The CVE record rates this as high severity (CVSS 8.1), while the vendor advisory describes a read/write primitive without code execution or privilege escalation.
Ghost Squared · Ghost Commander
