CVE-2024-54461
- Source
- https://cve.org/CVERecord?id=CVE-2024-54461
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-54461.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2024-54461
- Aliases
-
- GHSA-r465-vhm9-7r5h
- Published
- 2025-01-29T11:51:04Z
- Modified
- 2026-08-12T15:15:43Z
- Severity
-
- 2.1 (Low) CVSS_V4 - CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:A/VC:N/VI:L/VA:L/SC:N/SI:H/SA:H CVSS Calculator
- Summary
- Unsanitized Filenames in Flutter package file_selector_android Allow File Overwrites
- Details
-
The file names constructed within file_selector are missing sanitization checks leaving them vulnerable to malicious document providers. This may result in cases where a user with a malicious document provider installed can select a document file from that provider while using your app and could potentially override internal files in your app cache. Issue patched in 0.5.1+12. It is recommended to update to the latest version of file_selector_android that contains the changes to address this vulnerability.
- Database specific
{ "cna_assigner": "Google", "cwe_ids": [ "CWE-23" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/54xxx/CVE-2024-54461.json" }- References
Affected packages
Git / github.com/flutter/packages
Affected ranges
- Type
- GIT
- Repo
- https://github.com/flutter/packages
- Events
- Database specific
-
Show details
{ "cpe": "cpe:2.3:a:flutter:file_selector_android:*:*:*:*:*:*:*:*", "extracted_events": [ { "introduced": "0.5.1" }, { "last_affected": "0.5.1+11" }, { "fixed": "0.5.1\\+12" } ], "source": [ "AFFECTED_FIELD", "CPE_RANGE" ] }
Database specific
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-54461.json"
vanir_signatures
[
{
"deprecated": false,
"digest": {
"line_hashes": [
"14915844954117986140664795554901177823",
"322825527111562510057493791965970601081",
"22447763621534621797352989896425818673",
"254752550857704959700509648040875888483",
"177556396437130583238148032080412444241",
"183762905606068317178323576383974637444",
"276614070621110469886512145886801924178",
"179808410280558434955790448520081437521",
"178104538521220054231206798677976378800",
"277035193991753431692918710936734579538"
],
"threshold": 0.9
},
"id": "CVE-2024-54461-2585998c",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/flutter/packages/commit/f7667a655bc603fa996c9b4a4c8f7f525d52eef7",
"target": {
"file": "packages/file_selector/file_selector_android/android/src/main/java/dev/flutter/packages/file_selector_android/FileSelectorApiImpl.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "275189911192356174495302985552716397720",
"length": 208
},
"id": "CVE-2024-54461-2ed55f73",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/flutter/packages/commit/f7667a655bc603fa996c9b4a4c8f7f525d52eef7",
"target": {
"file": "packages/file_selector/file_selector_android/android/src/main/java/dev/flutter/packages/file_selector_android/GeneratedFileSelectorApi.java",
"function": "toList"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "320827989524663524907493634676515682833",
"length": 398
},
"id": "CVE-2024-54461-438ffc77",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/flutter/packages/commit/f7667a655bc603fa996c9b4a4c8f7f525d52eef7",
"target": {
"file": "packages/file_selector/file_selector_android/android/src/main/java/dev/flutter/packages/file_selector_android/GeneratedFileSelectorApi.java",
"function": "equals"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"34429543003713881323501335036539555026",
"41662835727306584933692227769854577213",
"60605480546360542588404936363027473843",
"337275648630288042630184512280060667085",
"329896713926706098156501992730058790827",
"173105409071285265290343203101319779938",
"327077103063922954179448347557807043549",
"286542082236519242290822018946533885049",
"123070113062205069393338894051640853304",
"35879109926956856881919470436485096652",
"216578663730602523496998173121097143525",
"322494857338834075150531299889402046369",
"63487774593080574848321475407858720785",
"38045277653929417308324295180772438014",
"274569118572980359579810172863603403872",
"51152069207184880296011246867887001090",
"331192451866257386464319033369989763611",
"112177380392747903775876090439902877003",
"134132253514745138764416332247024980833",
"82120482019023119078871693201173885897",
"233552094471259772818558775361367502471",
"123327012930648521491165861746596866900",
"230139394538464728614137585409753289460",
"320090155857641966384158184423522057357",
"31242908941615012032603427420176129875",
"286881418652016288649397719679076334364",
"55331158871516702564907417104530891105",
"320728785228666707296098012164896654810",
"7010374547915435054777346414541917572",
"180974242317979393521399863452424303685",
"204587408889817640077570352602230622779",
"232426530354484117598208971811243233580",
"253375223037471334407767249831887521173",
"299747811156237543167830466993855589609",
"177558477435862163130109732504069299899"
],
"threshold": 0.9
},
"id": "CVE-2024-54461-4f9c65d5",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/flutter/packages/commit/f7667a655bc603fa996c9b4a4c8f7f525d52eef7",
"target": {
"file": "packages/file_selector/file_selector_android/android/src/main/java/dev/flutter/packages/file_selector_android/FileUtils.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "87933776127155777677768208960535791224",
"length": 198
},
"id": "CVE-2024-54461-6b59dd8d",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/flutter/packages/commit/f7667a655bc603fa996c9b4a4c8f7f525d52eef7",
"target": {
"file": "packages/file_selector/file_selector_android/android/src/main/java/dev/flutter/packages/file_selector_android/GeneratedFileSelectorApi.java",
"function": "build"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "287291492903629461879364941022641886806",
"length": 880
},
"id": "CVE-2024-54461-7dfd4610",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/flutter/packages/commit/f7667a655bc603fa996c9b4a4c8f7f525d52eef7",
"target": {
"file": "packages/file_selector/file_selector_android/android/src/main/java/dev/flutter/packages/file_selector_android/FileUtils.java",
"function": "getPathFromCopyOfFileFromUri"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "250400676049272668000806822671244396105",
"length": 517
},
"id": "CVE-2024-54461-81d873c2",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/flutter/packages/commit/f7667a655bc603fa996c9b4a4c8f7f525d52eef7",
"target": {
"file": "packages/file_selector/file_selector_android/android/src/main/java/dev/flutter/packages/file_selector_android/FileUtils.java",
"function": "getFileExtension"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "18632150856027093914312653966638842874",
"length": 445
},
"id": "CVE-2024-54461-8e2bd829",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/flutter/packages/commit/f7667a655bc603fa996c9b4a4c8f7f525d52eef7",
"target": {
"file": "packages/file_selector/file_selector_android/android/src/main/java/dev/flutter/packages/file_selector_android/GeneratedFileSelectorApi.java",
"function": "fromList"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "157358320404309095963759313853251015908",
"length": 1267
},
"id": "CVE-2024-54461-98680329",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/flutter/packages/commit/f7667a655bc603fa996c9b4a4c8f7f525d52eef7",
"target": {
"file": "packages/file_selector/file_selector_android/android/src/main/java/dev/flutter/packages/file_selector_android/FileSelectorApiImpl.java",
"function": "toFileResponse"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "255877141358380351301530052024014849808",
"length": 304
},
"id": "CVE-2024-54461-bed35eae",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/flutter/packages/commit/f7667a655bc603fa996c9b4a4c8f7f525d52eef7",
"target": {
"file": "packages/file_selector/file_selector_android/android/src/main/java/dev/flutter/packages/file_selector_android/GeneratedFileSelectorApi.java",
"function": "readValueOfType"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "208036713789381047781662464736199200183",
"length": 149
},
"id": "CVE-2024-54461-bfb347a5",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/flutter/packages/commit/f7667a655bc603fa996c9b4a4c8f7f525d52eef7",
"target": {
"file": "packages/file_selector/file_selector_android/android/src/main/java/dev/flutter/packages/file_selector_android/GeneratedFileSelectorApi.java",
"function": "hashCode"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"339304054935403864058920699204499415212",
"151726828148292925868509794924113352232",
"173391507318276116129601560739158508675",
"132059481061825578821520273959087602510",
"162621547946147290122960071048855187682",
"180178452258808785809825564758504962454",
"53946151170790190931272623154906451763",
"144272614684527420116127645029927996165",
"175475946105309355398194831687746917893",
"4335871449990293347082633321392291777",
"73843643723472808747278027147594965764",
"130786971317681310638891011844160883042",
"239674889810038663456666258917396167769",
"256371758653074223948406274465553807220",
"291897208767407023181119985351168337658",
"168621802286684925678484424197592750411",
"180724025126081467652442728298547106875",
"319526775209835110432156177345155806791",
"187260712792097687562031905364520817797",
"81502870623012835107452933094952097215",
"304631963263555513111777453593383230804",
"101770862765514145523606219189604546077",
"222294352583366024377603673093709401825",
"299587670694324473438051942051342118240",
"157252618531958492774958426553507857904",
"128915261411030307187125779514499394185",
"256247793365102887285848656872985373589",
"208875203679150480211755034499321599292",
"248262585941474061482920743163414117084",
"6787890327123429999107524848591567269"
],
"threshold": 0.9
},
"id": "CVE-2024-54461-c1e9a42d",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/flutter/packages/commit/f7667a655bc603fa996c9b4a4c8f7f525d52eef7",
"target": {
"file": "packages/file_selector/file_selector_android/android/src/test/java/dev/flutter/packages/file_selector_android/FileUtilsTest.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "1648738901513572658286615495636383088",
"length": 347
},
"id": "CVE-2024-54461-c5a78e51",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/flutter/packages/commit/f7667a655bc603fa996c9b4a4c8f7f525d52eef7",
"target": {
"file": "packages/file_selector/file_selector_android/android/src/main/java/dev/flutter/packages/file_selector_android/GeneratedFileSelectorApi.java",
"function": "writeValue"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "221423677949625194065250329430579176029",
"length": 228
},
"id": "CVE-2024-54461-c72a7ac0",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/flutter/packages/commit/f7667a655bc603fa996c9b4a4c8f7f525d52eef7",
"target": {
"file": "packages/file_selector/file_selector_android/android/src/main/java/dev/flutter/packages/file_selector_android/FileUtils.java",
"function": "getFileName"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"87984595914603486241825163704092854666",
"268197825671285512726484273751326243694",
"26266326636066475666226707224679378905",
"329309017039321678606085779314469995012",
"270492673993448155830083308276702575105",
"190979773086109802637337091796699775005",
"127959990860722687809526917245361625468",
"36582625895931961862728585753821927622",
"311345900000261286340932259583988185677",
"104936829775904557203572465600738251463",
"199975646257496063729024817017647427658",
"44664748720936776445589100538256310914",
"259981078851985898662587456923909841725",
"142838353231597792284522091251788840492",
"150959287636117028359819211505377080270",
"257366162737309639516041782832175482851",
"214644496561553736041936525463618393534",
"52818238189544963166239052971721178942",
"270804919421357291304697966954018757136",
"176256218955970798278085489987843298749",
"48879548309217680212190619882588631221",
"165551490325928197189337575330360220332",
"154897332581718244075922891221078596774",
"127508406773661730379550271087768899073",
"28418871355649270036893694946705930010",
"245466659445926834629512119818996962307",
"126031863889703092246220639528854842005",
"233390420454453247242991257154483637852",
"168100954532823132149295076442021457193",
"146337027228587735935371743086529053856",
"61139319256782888165728278310342633831",
"65750903483179090238503990049096316542",
"153536846937749463949771224503592839540",
"27587691430666109427888566873723902672",
"265754647629309324726471151238020366720",
"170390782226329473062466047619428976895",
"273091012437001312879354807261108943877",
"66253938274232653176163583232290600570",
"219899265773637114354478374367613481026",
"66669590865087448355485255809337585560",
"156024085327563057080590749568909546944",
"160995136195964672209830163525998350796",
"281405719895696149508930303890660249715",
"246234614390628465625214381364845204525",
"245095715321200151060627575398562327675",
"291650481358628442763081327219038241551",
"220576968185250571260724508070501744465",
"267108692135850174880121815130166943313",
"331704867941947751635831348796185441992",
"244135279982203399352006396695870298275"
],
"threshold": 0.9
},
"id": "CVE-2024-54461-d144e092",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/flutter/packages/commit/f7667a655bc603fa996c9b4a4c8f7f525d52eef7",
"target": {
"file": "packages/file_selector/file_selector_android/android/src/main/java/dev/flutter/packages/file_selector_android/GeneratedFileSelectorApi.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "2451892259864020954819371459949174601",
"length": 397
},
"id": "CVE-2024-54461-d5d11bf6",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/flutter/packages/commit/f7667a655bc603fa996c9b4a4c8f7f525d52eef7",
"target": {
"file": "packages/file_selector/file_selector_android/android/src/test/java/dev/flutter/packages/file_selector_android/FileUtilsTest.java",
"function": "getPathFromCopyOfFileFromUri_returnsNullPathWhenSecurityExceptionThrown"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"83293720030543162863424579508728931118",
"201236680400842121952662628470995640395",
"206074584905026985914258240806484034506",
"138892894049177552867593602540618140717",
"107108726385451366070911529898983507058"
],
"threshold": 0.9
},
"id": "CVE-2024-54461-dc2f7224",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/flutter/packages/commit/f7667a655bc603fa996c9b4a4c8f7f525d52eef7",
"target": {
"file": "packages/file_selector/file_selector_android/android/src/test/java/dev/flutter/packages/file_selector_android/FileSelectorAndroidPluginTest.java"
}
}
]
vanir_signatures_modified
"2026-08-12T15:15:43Z"