# Exported component path traversal

Exported providers/activities resolving caller-supplied paths or URIs without normalization or scheme checks

_Area: Mobile app security. Seen in 7 disclosed reports; 2 confirmed bounties: $100 and $1,337; latest 2021-10-27. Updated 2026-10-23._

## How it works
An exported Android component (provider or activity) accepts a path, filename, or URI from the caller and turns it into a file operation without checking that the result stays inside the intended directory or scheme. The component runs with the app's (or system's) identity, so the file access bypasses Linux/SELinux permissions. The broken assumption: that callers only pass paths the component meant to serve.

## Where it shows up
- Providers using `openFileHelper` with a client-writable `_data` column [E1](https://bugbountylibrary.com/r/p0%3ACVE-2021-25337.md)
- FileProvider paths XML with `root-path` and `path="."` or overly broad roots [E2](https://bugbountylibrary.com/r/h1%3A876192.md)
- Exported activities whose intent filters accept `file://` or broad schemes [E3](https://bugbountylibrary.com/r/blog%3Aservicenger-com-blog-mobile-google-photos-theft-of-database-arbitrary-files-android-vulnerability.md)[E5](https://bugbountylibrary.com/r/h1%3A1122177.md)
- Providers keyed by caller-supplied filenames with no access check [E4](https://bugbountylibrary.com/r/h1%3A534541.md)
- `Uri.getLastPathSegment()` used as a path (decodes `%2F`) [E6](https://bugbountylibrary.com/r/blog%3Ablog-oversecured-com-two-weeks-of-securing-samsung-devices-part-2.md)
- `<permission>` without `protectionLevel` (defaults to normal) [E6](https://bugbountylibrary.com/r/blog%3Ablog-oversecured-com-two-weeks-of-securing-samsung-devices-part-2.md)
- Upload pickers trusting `file://` URIs returned by GET_CONTENT [E7](https://bugbountylibrary.com/r/h1%3A1142918.md)

## How to review
For each exported component, trace caller-controlled input to the file open. The invariant: the resolved canonical path must stay within the component's intended directory, and the scheme must be an allowed one. Check manifest export flags and permissions; check whether `_data`/filename columns are writable by callers; check FileProvider path configs for broad roots; check whether the app self-resolves its own content URIs without grants [E2](https://bugbountylibrary.com/r/h1%3A876192.md); check deep-link routers for scheme/host validation before handing URIs to a WebView [E5](https://bugbountylibrary.com/r/h1%3A1122177.md); check GET_CONTENT consumers reject `file://` into their own sandbox [E7](https://bugbountylibrary.com/r/h1%3A1142918.md).

## Variants seen
- System provider returning fd for arbitrary `_data` path [E1](https://bugbountylibrary.com/r/p0%3ACVE-2021-25337.md)
- Over-broad FileProvider root plus self-resolution and auto-download [E2](https://bugbountylibrary.com/r/h1%3A876192.md)
- Exported activity accepting `file://` into app sandbox [E3](https://bugbountylibrary.com/r/blog%3Aservicenger-com-blog-mobile-google-photos-theft-of-database-arbitrary-files-android-vulnerability.md)
- Chained providers: filename leak plus filename-keyed cache provider [E4](https://bugbountylibrary.com/r/h1%3A534541.md)
- Deep-link activity forwarding `file://` to in-app browser [E5](https://bugbountylibrary.com/r/h1%3A1122177.md)
- `%2F` decoding via `getLastPathSegment` and missing protectionLevel [E6](https://bugbountylibrary.com/r/blog%3Ablog-oversecured-com-two-weeks-of-securing-samsung-devices-part-2.md)
- Malicious GET_CONTENT responder returning `file://` into victim sandbox [E7](https://bugbountylibrary.com/r/h1%3A1142918.md)

## Impact and severity
Led to arbitrary file read/write as system UID [E1](https://bugbountylibrary.com/r/p0%3ACVE-2021-25337.md)[E6](https://bugbountylibrary.com/r/blog%3Ablog-oversecured-com-two-weeks-of-securing-samsung-devices-part-2.md), cookie and token theft [E2](https://bugbountylibrary.com/r/h1%3A876192.md)[E5](https://bugbountylibrary.com/r/h1%3A1122177.md)[E7](https://bugbountylibrary.com/r/h1%3A1142918.md), and private database/thumbnail disclosure [E3](https://bugbountylibrary.com/r/blog%3Aservicenger-com-blog-mobile-google-photos-theft-of-database-arbitrary-files-android-vulnerability.md)[E4](https://bugbountylibrary.com/r/h1%3A534541.md). Severity rises when the component runs as a privileged UID, when no permission gates it, and when a second component leaks the filenames needed to target the first [E4](https://bugbountylibrary.com/r/h1%3A534541.md).

## Evidence
- E1: https://bugbountylibrary.com/r/p0%3ACVE-2021-25337.md
- E2: https://bugbountylibrary.com/r/h1%3A876192.md
- E3: https://bugbountylibrary.com/r/blog%3Aservicenger-com-blog-mobile-google-photos-theft-of-database-arbitrary-files-android-vulnerability.md
- E4: https://bugbountylibrary.com/r/h1%3A534541.md
- E5: https://bugbountylibrary.com/r/h1%3A1122177.md
- E6: https://bugbountylibrary.com/r/blog%3Ablog-oversecured-com-two-weeks-of-securing-samsung-devices-part-2.md
- E7: https://bugbountylibrary.com/r/h1%3A1142918.md