Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Low severity, with a CVSS score of 1.1, published 21 May 2026.

Which products and versions are affected?

github.com/mvt-project/androidqf (Go) <= 1.8.2; Mvt-Project Androidqf <= 1.8.2.

Is there a fix for This vulnerability?

A patch was published on 2026-05-12: Version 1.8.3 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked with local access, in a software library.

Check whether you run github.com/mvt-project/androidqf (Go) or Mvt-Project Androidqf at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

mvt-project androidqf path traversal in APK acquisition

Q: Is there a fix for This vulnerability?

A patch was published on 2026-05-12: Version 1.8.3 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is This vulnerability attacked?

It is attacked with local access, in a software library.

Q: Am I affected?

Check whether you run github.com/mvt-project/androidqf (Go) or Mvt-Project Androidqf at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Severity: low · CVSS 1.1 · Published 2026-05-21

androidqf is a tool used for forensic acquisition and analysis of Android devices. A vulnerability exists where a compromised or malicious mobile device could trick the tool into writing files to unintended locations on the investigator's computer. This could potentially allow an attacker to overwrite sensitive system files or configuration data on the workstation used to perform the forensic collection.

Technologies: github.com/mvt-project/androidqf (Go). Vendors: Go.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Low severity, with a CVSS score of 1.1, published 21 May 2026.
Which products and versions are affected?: github.com/mvt-project/androidqf (Go) <= 1.8.2; Mvt-Project Androidqf <= 1.8.2.
Is there a fix for This vulnerability?: A patch was published on 2026-05-12: Version 1.8.3 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked with local access, in a software library.
Am I affected?: Check whether you run github.com/mvt-project/androidqf (Go) or Mvt-Project Androidqf at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A path traversal vulnerability exists in the `getPathToLocalCopy()` function of androidqf. The tool extracts filenames for downloaded APKs using `extractFileName()`, which splits strings on the `==/` delimiter but fails to sanitize the resulting path component. When these unsanitized components are passed to `filepath.Join`, an attacker-controlled device can provide crafted paths containing traversal sequences (e.g., `../`). This allows the tool to write files outside the designated `apks/` directory on the acquisition workstation. While Android's internal package path restrictions limit practical exploitability, this represents a defense-in-depth failure. The issue is addressed in version 1.8.3.

Affected products

mvt-project androidqf <= 1.8.2

Timeline

2026-05-12: patched: Version 1.8.3 released
2026-05-14: disclosed
2026-05-21: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.