The file names constructed within imagepicker are missing sanitization checks leaving them vulnerable to malicious document providers. This may result in cases where a user with a malicious document provider installed can select an image file from that provider while using your app and could potentially override internal files in your app cache. Issue patched in 0.8.12+18. It is recommended to update to the latest version of imagepicker_android that contains the changes to address this vulnerability.
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-54462.json"
[
{
"source": "https://github.com/flutter/packages/commit/bc0c22d57910047fff7569ccb4413cf031304c7d",
"digest": {
"line_hashes": [
"303314784481201181720150525062765273463",
"20880223019726072959532360028721755702",
"6989478055315134737728786613299522725",
"64645551256649760386703777759641158255",
"227545703528477010933343998116576626353",
"37983777764155064354533960192610077486",
"83194342221027327771846059640882599530",
"63487774593080574848321475407858720785",
"38045277653929417308324295180772438014",
"274569118572980359579810172863603403872",
"51152069207184880296011246867887001090",
"331192451866257386464319033369989763611",
"112177380392747903775876090439902877003",
"134132253514745138764416332247024980833",
"233552094471259772818558775361367502471",
"123327012930648521491165861746596866900",
"230139394538464728614137585409753289460",
"285535178883998415427266962291039082522",
"31242908941615012032603427420176129875",
"286881418652016288649397719679076334364",
"218895900953662230366556233691163097969",
"31284385480650232206277938210489969471",
"314853112747901469146344434050071313395",
"90538332385013907141409689303033930387",
"253804600369756417313249713451164783606",
"232426530354484117598208971811243233580",
"186310532186494349787563482538969929593"
],
"threshold": 0.9
},
"id": "CVE-2024-54462-3830742c",
"deprecated": false,
"target": {
"file": "packages/image_picker/image_picker_android/android/src/main/java/io/flutter/plugins/imagepicker/FileUtils.java"
},
"signature_type": "Line",
"signature_version": "v1"
},
{
"source": "https://github.com/flutter/packages/commit/bc0c22d57910047fff7569ccb4413cf031304c7d",
"digest": {
"line_hashes": [
"278390660004063027598380676164269206272",
"190435323530435302632815176995415338216",
"332586687262981138583854723135593588892",
"49456586401520649091797863802506347988",
"20687661165566140451256812671975220414",
"337871242830709894634362036921358616347",
"248262585941474061482920743163414117084",
"6787890327123429999107524848591567269"
],
"threshold": 0.9
},
"id": "CVE-2024-54462-4093ba6a",
"deprecated": false,
"target": {
"file": "packages/image_picker/image_picker_android/android/src/test/java/io/flutter/plugins/imagepicker/FileUtilTest.java"
},
"signature_type": "Line",
"signature_version": "v1"
},
{
"source": "https://github.com/flutter/packages/commit/bc0c22d57910047fff7569ccb4413cf031304c7d",
"digest": {
"length": 843.0,
"function_hash": "7512354840878972151149523160661010195"
},
"id": "CVE-2024-54462-9dbb5a4d",
"deprecated": false,
"target": {
"function": "getPathFromUri",
"file": "packages/image_picker/image_picker_android/android/src/main/java/io/flutter/plugins/imagepicker/FileUtils.java"
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"source": "https://github.com/flutter/packages/commit/bc0c22d57910047fff7569ccb4413cf031304c7d",
"digest": {
"length": 228.0,
"function_hash": "221423677949625194065250329430579176029"
},
"id": "CVE-2024-54462-c875d29d",
"deprecated": false,
"target": {
"function": "getImageName",
"file": "packages/image_picker/image_picker_android/android/src/main/java/io/flutter/plugins/imagepicker/FileUtils.java"
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"source": "https://github.com/flutter/packages/commit/bc0c22d57910047fff7569ccb4413cf031304c7d",
"digest": {
"length": 488.0,
"function_hash": "217953262944580300536547523318579476174"
},
"id": "CVE-2024-54462-d3c432c9",
"deprecated": false,
"target": {
"function": "getImageExtension",
"file": "packages/image_picker/image_picker_android/android/src/main/java/io/flutter/plugins/imagepicker/FileUtils.java"
},
"signature_type": "Function",
"signature_version": "v1"
}
]
"2026-04-12T11:14:33Z"