Unscored severity · published Oct 29, 2026
CVE-2026-107018
Insecure permissions in Ghost Commander File Manager versionCode 479 allows unauthorized attackers to arbitrarily read and write files inside the commander's private storage
New
–
CVSS
–
EPSS
No
On KEV
Description
Insecure permissions in Ghost Commander File Manager versionCode 479 allows unauthorized attackers to arbitrarily read and write files inside the commander's private storage.
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-107018
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-107018
f-droid.org
https://f-droid.org/packages/com.ghostsq.commander/
github.com
https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107018.md
sourceforge.net
https://sourceforge.net/p/ghostcommander