PT-2026-45227 · Go · Github.Com/Mvt-Project/Androidqf
Publicado
2026-05-21
·
Atualizado
2026-05-21
CVSS v4.0
1.1
Baixa
| Vetor | AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U |
Summary
During device acquisition,
getPathToLocalCopy() constructs local filesystem paths for downloaded APKs using a filename component extracted by extractFileName(). The extraction splits on ==/ and takes the remainder without sanitization. If a compromised device returns a crafted APK path containing traversal sequences, filepath.Join resolves them, allowing the file to be written outside the intended apks/ directory.Practical exploitability is limited because Android enforces strict package path formats under
/data/app/ and does not allow apps to register paths containing traversal sequences. Rated Informational as a defense-in-depth concern.Impact
An attacker with control of the connected device could potentially write files outside the expected output directory on the acquisition workstation, leading to arbitrary file overwrite with attacker-controlled content.
Patched version
Credits
- This issue was identified during a security assessment conducted by 0xche.
- An additional vulnerability was independently identified by @0x0v1
Correção
Path traversal
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Github.Com/Mvt-Project/Androidqf