Executive brief
AndroidQF is a forensic tool used to collect data from Android devices for security analysis. A vulnerability exists where a compromised mobile device can provide malicious file names that include path traversal sequences (like ../) when the tool creates a backup bundle. If a forensic analyst later extracts this bundle using a tool without specific protections, files could be written to unauthorized locations on the analyst's computer, potentially compromising the investigation or the workstation.
Technical details
A path traversal vulnerability (Zip Slip) exists in the generateZipPath() function of androidqf. The function uses device-controlled content from extractFileName() to construct zip entry names for collected APKs without properly neutralizing traversal sequences. While androidqf itself does not extract these files, it creates a malicious ZIP archive that can trigger path traversal when processed by downstream forensic tools or analysts. An attacker with control over an Android device being analyzed can inject '../' sequences into filenames to write files outside the intended extraction directory on the host machine. This issue is fixed in version 1.8.3.
Affected products
- mvt-project androidqf <= 1.8.2
Timeline
- 2026-05-12: patched: Version 1.8.3 released
- 2026-05-14: disclosed: Initial disclosure on GitHub
- 2026-05-21: advisory: GitHub Advisory published