Path Traversal Vulnerability in ALEAPP Android Logs Events and Protobuf Parser

CVE-2026-40027

What is CVE-2026-40027?

ALEAPP, specifically in version 3.4.0, has a path traversal vulnerability in the NQ_Vault.py artifact parser. This issue arises from the use of attacker-controlled file_name_from values from a database as the output filename, allowing for arbitrary file writes outside the designated report output directory. An attacker can exploit this vulnerability by embedding a path traversal payload, enabling them to write files to undesired locations. This poses significant risks, such as potential code execution through overwriting executable files or configuration settings.

References