GHSA-763j-3p5v-jfc6
androidqf: APK download Path Traversal in device APK paths
Summary
During device acquisition, getPathToLocalCopy() constructs local filesystem paths for downloaded APKs using a filename component extracted by extractFileName(). The extraction splits on ==/ and takes the remainder without sanitization. If a compromised device returns a crafted APK path containing traversal sequences, filepath.Join resolves them, allowing the file to be written outside the intended apks/ directory.
Practical exploitability is limited because Android enforces strict package path formats under /data/app/ and does not allow apps to register paths containing traversal sequences. Rated Informational as a defense-in-depth concern.
Impact
An attacker with control of the connected device could potentially write files outside the expected output directory on the acquisition workstation, leading to arbitrary file overwrite with attacker-controlled content.
Patched version
Credits
- This issue was identified during a security assessment conducted by 0xche.
- An additional vulnerability was independently identified by @0x0v1
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Passive
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
What each source reports
GitHub Advisories Score used
androidqf: APK download Path Traversal in device APK paths
Summary
During device acquisition, getPathToLocalCopy() constructs local filesystem paths for downloaded APKs using a filename component extracted by extractFileName(). The extraction splits on ==/ and takes the remainder without sanitization. If a compromised device returns a crafted APK path containing traversal sequences, filepath.Join resolves them, allowing the file to be written outside the intended apks/ directory.
Practical exploitability is limited because Android enforces strict package path formats under /data/app/ and does not allow apps to register paths containing traversal sequences. Rated Informational as a defense-in-depth concern.
Impact
An attacker with control of the connected device could potentially write files outside the expected output directory on the acquisition workstation, leading to arbitrary file overwrite with attacker-controlled content.
Patched version
Credits
- This issue was identified during a security assessment conducted by 0xche.
- An additional vulnerability was independently identified by @0x0v1
- Record
GHSA-763j-3p5v-jfc6- CVSS 4.0
- 1.1 Low
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U - Weakness
- CWE-22
- Updated
- 2026-11-02
OSV
androidqf: APK download Path Traversal in device APK paths
Summary
During device acquisition, getPathToLocalCopy() constructs local filesystem paths for downloaded APKs using a filename component extracted by extractFileName(). The extraction splits on ==/ and takes the remainder without sanitization. If a compromised device returns a crafted APK path containing traversal sequences, filepath.Join resolves them, allowing the file to be written outside the intended apks/ directory.
Practical exploitability is limited because Android enforces strict package path formats under /data/app/ and does not allow apps to register paths containing traversal sequences. Rated Informational as a defense-in-depth concern.
Impact
An attacker with control of the connected device could potentially write files outside the expected output directory on the acquisition workstation, leading to arbitrary file overwrite with attacker-controlled content.
Patched version
Credits
- This issue was identified during a security assessment conducted by 0xche.
- An additional vulnerability was independently identified by @0x0v1
- Record
GHSA-763j-3p5v-jfc6- CVSS 4.0
- 1.1 Low
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U - Weakness
- CWE-22
- Updated
- 2026-11-02
OSVGO-2026-5206No score
androidqf: APK download Path Traversal in device APK paths in github.com/mvt-project/androidqf
androidqf: APK download Path Traversal in device APK paths in github.com/mvt-project/androidqf
- Record
GO-2026-5206- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
github.com/mvt-project/androidqfGo | through 1.8.2 | 1.8.3 |
github.com/mvt-project/androidqfGo | before 1.8.3 | 1.8.3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-763j-3p5v-jfc6 is a low vulnerability (CVSS 1.1) in github.com/mvt-project/androidqf, published May 21, 2026. No source lists public exploit code. Fixed in github.com/mvt-project/androidqf 1.8.3.