Executive brief
androidqf is a tool used for forensic acquisition and analysis of Android devices. A vulnerability exists where a compromised or malicious mobile device could trick the tool into writing files to unintended locations on the investigator's computer. This could potentially allow an attacker to overwrite sensitive system files or configuration data on the workstation used to perform the forensic collection.
Technical details
A path traversal vulnerability exists in the `getPathToLocalCopy()` function of androidqf. The tool extracts filenames for downloaded APKs using `extractFileName()`, which splits strings on the `==/` delimiter but fails to sanitize the resulting path component. When these unsanitized components are passed to `filepath.Join`, an attacker-controlled device can provide crafted paths containing traversal sequences (e.g., `../`). This allows the tool to write files outside the designated `apks/` directory on the acquisition workstation. While Android's internal package path restrictions limit practical exploitability, this represents a defense-in-depth failure. The issue is addressed in version 1.8.3.
Affected products
- mvt-project androidqf <= 1.8.2
Timeline
- 2026-05-12: patched: Version 1.8.3 released
- 2026-05-14: disclosed
- 2026-05-21: advisory