CVE-2026-107018

{"dataType": "CVE_RECORD", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2026-107018", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2026-11-03T00:20:38.331Z", "dateReserved": "2026-10-07T00:00:00.000Z", "datePublished": "2026-10-29T00:00:00.000Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-10-29T14:44:40.204Z"}, "descriptions": [{"lang": "en", "value": "Insecure permissions in Ghost Commander File Manager versionCode 479 allows unauthorized attackers to arbitrarily read and write files inside the commander's private storage."}], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"version": "n/a", "status": "affected"}]}], "references": [{"url": "https://f-droid.org/packages/com.ghostsq.commander/"}, {"url": "https://sourceforge.net/p/ghostcommander"}, {"url": "https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107018.md"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "n/a"}]}]}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-732", "lang": "en", "description": "CWE-732 Incorrect Permission Assignment for Critical Resource"}]}], "references": [{"url": "https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107018.md", "tags": ["exploit"]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-11-03T00:19:21.299367Z", "id": "CVE-2026-107018", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-03T00:20:38.331Z"}}]}, "dataVersion": "5.2"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-107018", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-11-03T00:19:21.299367Z"}}}], "references": [{"url": "https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107018.md", "tags": ["exploit"]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-732", "description": "CWE-732 Incorrect Permission Assignment for Critical Resource"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-03T00:20:01.102Z"}}], "cna": {"affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "references": [{"url": "https://f-droid.org/packages/com.ghostsq.commander/"}, {"url": "https://sourceforge.net/p/ghostcommander"}, {"url": "https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107018.md"}], "descriptions": [{"lang": "en", "value": "Insecure permissions in Ghost Commander File Manager versionCode 479 allows unauthorized attackers to arbitrarily read and write files inside the commander's private storage."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "n/a"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-10-29T14:44:40.204Z"}}}, "cveMetadata": {"cveId": "CVE-2026-107018", "state": "PUBLISHED", "dateUpdated": "2026-11-03T00:20:38.331Z", "dateReserved": "2026-10-07T00:00:00.000Z", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2026-10-29T00:00:00.000Z", "assignerShortName": "mitre"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "source": "cve@mitre.org"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Insecure permissions in Ghost Commander File Manager versionCode 479 allows unauthorized attackers to arbitrarily read and write files inside the commander's private storage."}], "id": "CVE-2026-107018", "lastModified": "2026-11-03T01:16:45.223", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.2, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-107018", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-11-03T00:19:21.299367Z", "version": "2.0.3"}}]}, "published": "2026-10-29T15:17:15.550", "references": [{"source": "cve@mitre.org", "url": "https://f-droid.org/packages/com.ghostsq.commander/"}, {"source": "cve@mitre.org", "url": "https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107018.md"}, {"source": "cve@mitre.org", "url": "https://sourceforge.net/p/ghostcommander"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107018.md"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-732"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"bugzilla": {"description": "ghostcommander: Ghost Commander: Arbitrary file read and write via insecure permissions", "id": "2563401", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2563401"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.1", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "status": "draft"}, "cwe": "CWE-276", "details": ["Insecure permissions in Ghost Commander File Manager versionCode 479 allows unauthorized attackers to arbitrarily read and write files inside the commander's private storage.", "A flaw was found in Ghost Commander. Due to insecure permissions, an unauthorized attacker can access the application's private storage directory. This vulnerability allows attackers to arbitrarily read and modify sensitive files belonging to the application."], "name": "CVE-2026-107018", "public_date": "2026-10-29T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-107018\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-107018\nhttps://f-droid.org/packages/com.ghostsq.commander/\nhttps://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107018.md\nhttps://sourceforge.net/p/ghostcommander"], "statement": "This vulnerability is rated with an Important severity because it enables unauthorized local processes to access and tamper with private application data without adequate access controls. However, Ghost Commander is an Android-based utility and is not packaged or distributed in any Red Hat products. Consequently, Red Hat Enterprise Linux and other Red Hat supported environments are not affected by this flaw.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,479]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "n/a", "source": "cna", "vendor": "n/a"}, "product": "file_manager", "vendor": "ghostsq-commander"}], "created": "2026-10-29T19:00:08.249936+00:00", "updated": "2026-11-06T02:15:18.149924+00:00", "vendors": ["ghostsq-commander", "ghostsq-commander$PRODUCT$file_manager"]}