Owlfiles File Manager 12.0.1 - Path Traversal

The path traversal vulnerability in Owlfiles File Manager allows an attacker to bypass intended access controls and directly access files and directories on the device's file system. By crafting carefully designed GET requests with directory traversal sequences (e.g., ../..), an attacker can navigate outside the intended web application directory and access sensitive system files. This could include configuration files, database backups, or even executable code. Successful exploitation could lead to information disclosure, privilege escalation, and potentially remote code execution depending on the files accessed and their permissions. While no direct precedent exists for Owlfiles File Manager, path traversal vulnerabilities are frequently exploited to gain unauthorized access to sensitive data, similar to attacks targeting web servers and file sharing applications.

Users of Android devices running Owlfiles File Manager version 12.0.1 are at direct risk. Shared hosting environments or devices with weak access controls are particularly vulnerable, as an attacker could potentially leverage this vulnerability to gain broader access to the system. Users who store sensitive data within the file manager's accessible directories are also at increased risk.

• android / file-manager:

Get-InstalledPackage -Name "Owlfiles File Manager"

• android / file-manager:

# Check for suspicious files in accessible directories
Get-ChildItem -Path /data/data/com.owlfiles.filemanager/files/ -Recurse -ErrorAction SilentlyContinue | Where-Object {$_.Name -match "..\"}

• android / file-manager:

# Check for unusual network activity related to the file manager
netstat -an | grep :8080 # Assuming default port

1. 2026-01-13Disclosure

   disclosure

1. Reserviert2026-01-10
2. Veröffentlicht2026-01-13
3. Geändert2026-04-07
4. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2022-50890 is to upgrade Owlfiles File Manager to a patched version as soon as it becomes available. Until a patch is released, consider restricting access to the File Manager application to trusted users only. Implement strict input validation on all user-supplied data, particularly GET request parameters, to prevent directory traversal attempts. Web application firewalls (WAFs) can be configured with rules to detect and block requests containing directory traversal sequences. Monitor system logs for unusual file access patterns that might indicate exploitation. After upgrade, confirm by attempting a directory traversal request and verifying that access is denied.