file_selector_android Malicious Document Provider Vulnerability Allowing Cache File Overwrite

A vulnerability in the file_selector_android package, specifically in versions 0.5.1 through 0.5.1+11, allows malicious document providers to select files that can overwrite internal app cache files. This issue arises because the package fails to properly sanitize file names from document providers, creating a risk for users with malicious providers installed.

Impact

Exploitation of this vulnerability could lead to unauthorized modification of internal files in the app's cache.

Remediation

Users are advised to update to version 0.5.1+12 or later, which addresses this vulnerability.