Vulnerability · Published Jul 27, 2026 · Assigned by zte
CVE-2026-40000Path Traversal Vulnerability in ZTE Blade A75 5G
Low 1.8
In plain English
A low-severity path traversal in Blade A75 5G from ZTE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 10% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Official description
The Activity zte.com.cn.filer/zte.com.cn.filer.FilePreViewActivity within ZTE File Manager is designed to preview compressed files. Third-party applications can launch this Activity and supply arbitrary file paths (e.g., content://zte.com.cn.filer.fileprovider/root_path), enabling file access with the privilege level of ZTE File Manager. This allows unrooted devices to read files under certain system directories such as /data/data and /data/local/tmp. If access restrictions do not block untrusted applications, additional directories may also be accessible.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| ZTE | Blade A75 5G | A75 series project, versions released before 2026/05/30 |
Weakness: CWE-22 · Vector: CVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N