PT-2026-21279 · Unknown · Adb-Explorer

Blankshiro · Published 2026-02-20 · Updated 2026-02-20 · CVE-2026-27115

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions ADB Explorer versions 0.9.26020 and below

Description ADB Explorer, a fluent UI for ADB on Windows, contains a flaw due to an unvalidated command-line argument. This allows any user to trigger recursive deletion of arbitrary directories on the Windows filesystem. The application accepts a path argument to set a custom data directory, but only verifies its existence. The ClearDrag() method uses Directory.Delete(dir, true) on every subdirectory of the provided path during application startup and exit. An attacker can create a malicious shortcut or batch script that launches ADB Explorer with a critical directory as the argument, resulting in permanent, recursive deletion of all its subdirectories. This deletion bypasses the Recycle Bin.

Recommendations Update to version 0.9.26021 or later.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

CWE-73

Related Identifiers

CVE-2026-27115

GHSA-RG2H-2P33-RXCR

Affected Products

Adb-Explorer

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27115.json · Exploit
• https://github.com/Alex4SSB/ADB-Explorer/security/advisories/GHSA-rg2h-2p33-rxcr · Vendor Advisory
• https://github.com/Alex4SSB/ADB-Explorer/commit/f7554690b1f68c6066c12aa45aec60303bca545b · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-27115 · Security Note
• https://osv.dev/vulnerability/CVE-2026-27115 · Vendor Advisory
• https://github.com/Alex4SSB/ADB-Explorer/releases/tag/v0.9.26021 · Note
• https://t.me/CVEtracker/45300 · Telegram Post
• https://twitter.com/CVEnew/status/2024988776255422656 · Twitter Post