mvt-project androidqf path traversal in APK zip generation

Severity: low · CVSS 1.1 · Published 2026-05-21

AndroidQF is a forensic tool used to collect data from Android devices for security analysis. A vulnerability exists where a compromised mobile device can provide malicious file names that include path traversal sequences (like ../) when the tool creates a backup bundle. If a forensic analyst later extracts this bundle using a tool without specific protections, files could be written to unauthorized locations on the analyst's computer, potentially compromising the investigation or the workstation.

Technologies: github.com/mvt-project/androidqf (Go). Vendors: Go.

Quick answers

Is This vulnerability exploited in the wild?
No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?
Low severity, with a CVSS score of 1.1, published 21 May 2026.
Which products and versions are affected?
github.com/mvt-project/androidqf (Go) <= 1.8.2; Mvt-Project Androidqf <= 1.8.2.
Is there a fix for This vulnerability?
A patch was published on 2026-05-12: Version 1.8.3 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?
It is attacked with local access, in a software library.
Am I affected?
Check whether you run github.com/mvt-project/androidqf (Go) or Mvt-Project Androidqf at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A path traversal vulnerability (Zip Slip) exists in the generateZipPath() function of androidqf. The function uses device-controlled content from extractFileName() to construct zip entry names for collected APKs without properly neutralizing traversal sequences. While androidqf itself does not extract these files, it creates a malicious ZIP archive that can trigger path traversal when processed by downstream forensic tools or analysts. An attacker with control over an Android device being analyzed can inject '../' sequences into filenames to write files outside the intended extraction directory on the host machine. This issue is fixed in version 1.8.3.

Affected products

  • mvt-project androidqf <= 1.8.2

Timeline

  • 2026-05-12: patched: Version 1.8.3 released
  • 2026-05-14: disclosed: Initial disclosure on GitHub
  • 2026-05-21: advisory: GitHub Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.