PT-2025-3026 · Unknown · Image Picker Android+1

Oskar-Zeinomahmalat-Sonarsource · Published 2025-01-29 · Updated 2025-01-29 · CVE-2024-54462

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions image picker versions prior to 0.8.12+18 image picker android versions prior to 0.8.12+18

Description The file names constructed within image picker are missing sanitization checks, leaving them vulnerable to malicious document providers. This may result in cases where a user with a malicious document provider installed can select an image file from that provider while using the app and could potentially override internal files in the app cache.

Recommendations For image picker versions prior to 0.8.12+18, update to the latest version of image picker android that contains the changes to address this issue. For image picker android versions prior to 0.8.12+18, update to version 0.8.12+18 or later to resolve the vulnerability.

Fix

Path traversal

Relative Path Traversal

Weakness Enumeration

CWE-22

CWE-23

Related Identifiers

CVE-2024-54462

GHSA-98V2-F47X-89XW

Affected Products

Image Picker

Image Picker Android

References · 7

• https://github.com/flutter/packages/security/advisories/GHSA-98v2-f47x-89xw · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-54462 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-54462 · Security Note
• https://t.me/cvedetector/16683 · Telegram Post
• https://twitter.com/WolfgangSesin/status/1884587960655360071 · Twitter Post
• https://t.me/cvenotify/108971 · Telegram Post
• https://twitter.com/CVEnew/status/1884578388393808336 · Twitter Post