---
id: "CVE-2026-107018"
kind: "vulnerability"
aliases: ["CVE-2026-107018"]
title: "Ghost Commander File Manager: insecure permissions expose private storage files"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["android", "ghost-commander-file-manager", "other"]
not_affected_if: ["other-versions"]
published_at: "2026-10-29T15:17:15+00:00"
first_seen_at: "2026-10-29T15:25:38+00:00"
updated_at: "2026-10-29T15:27:15+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107018", "first_seen_at": "2026-10-29T15:25:38+00:00"}]
---

# Ghost Commander File Manager: insecure permissions expose private storage files

Ghost Commander File Manager version code 479 sets insecure permissions on its private storage. An unauthorized attacker can read and write files inside that private storage.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed app version code for Ghost Commander File Manager; the sources do not name a version string to compare against beyond `versionCode 479`.

## Timeline

- 2026-10-29T15:25:38+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-107018

## From the sources

Insecure permissions in Ghost Commander File Manager versionCode 479 allows unauthorized attackers to arbitrarily read and write files inside the commander's private storage.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_