References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [email protected].

Change History

{"timestamp":"2026-07-27T10:23:18.662109Z","id":"CVE-2026-40000","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}

The Activity zte.com.cn.filer/zte.com.cn.filer.FilePreViewActivity within ZTE File Manager is designed to preview compressed files. Third-party applications can launch this Activity and supply arbitrary file paths (e.g., content://zte.com.cn.filer.fileprovider/root_path), enabling file access with the privilege level of ZTE File Manager. This allows unrooted devices to read files under certain system directories such as /data/data and /data/local/tmp. If access restrictions do not block untrusted applications, additional directories may also be accessible.

AV:P/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

CWE-22

https://support.zte.com.cn/zte-iccp-isupport-webui/bulletin/detail/7341653040963675660

[{"vendor":"ZTE","product":"A75 Pro 5G","defaultStatus":"unaffected","versions":[{"version":"A75 Pro series project, versions released before 2026/05/30","status":"affected"}]}]