# mvt-project androidqf path traversal in APK zip generation

Source: https://junglewise.ai/threats/mvt-project-androidqf-path-traversal-in-apk-zip-generation-78b4bbdd  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-21. Updated: 2026-05-21  
License: CC BY 4.0 with a link back

Severity: low · CVSS 1.1 · Published 2026-05-21

AndroidQF is a forensic tool used to collect data from Android devices for security analysis. A vulnerability exists where a compromised mobile device can provide malicious file names that include path traversal sequences (like ../) when the tool creates a backup bundle. If a forensic analyst later extracts this bundle using a tool without specific protections, files could be written to unauthorized locations on the analyst's computer, potentially compromising the investigation or the workstation.

Technologies: [github.com/mvt-project/androidqf (Go)](https://junglewise.ai/threats/technologies/github-com-mvt-project-androidqf). Vendors: [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Low severity, with a CVSS score of 1.1, published 21 May 2026.

**Which products and versions are affected?** github.com/mvt-project/androidqf (Go) <= 1.8.2; Mvt-Project Androidqf <= 1.8.2.

**Is there a fix for This vulnerability?** A patch was published on 2026-05-12: Version 1.8.3 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked with local access, in a software library.

**Am I affected?** Check whether you run github.com/mvt-project/androidqf (Go) or Mvt-Project Androidqf at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A path traversal vulnerability (Zip Slip) exists in the generateZipPath() function of androidqf. The function uses device-controlled content from extractFileName() to construct zip entry names for collected APKs without properly neutralizing traversal sequences. While androidqf itself does not extract these files, it creates a malicious ZIP archive that can trigger path traversal when processed by downstream forensic tools or analysts. An attacker with control over an Android device being analyzed can inject '../' sequences into filenames to write files outside the intended extraction directory on the host machine. This issue is fixed in version 1.8.3.

## Affected products

- mvt-project androidqf <= 1.8.2

## Timeline

- 2026-05-12: patched: Version 1.8.3 released
- 2026-05-14: disclosed: Initial disclosure on GitHub
- 2026-05-21: advisory: GitHub Advisory published

## References

- [https://github.com/mvt-project/androidqf/security/advisories/GHSA-jf2q-463c-6f52](https://github.com/mvt-project/androidqf/security/advisories/GHSA-jf2q-463c-6f52)
- [https://github.com/mvt-project/androidqf/releases/tag/v1.8.3](https://github.com/mvt-project/androidqf/releases/tag/v1.8.3)
- [https://api.github.com/repos/mvt-project/androidqf/security-advisories/GHSA-jf2q-463c-6f52](https://api.github.com/repos/mvt-project/androidqf/security-advisories/GHSA-jf2q-463c-6f52)

## Related threats

- [GO-2026-5464 - androidqf: Zip entry Name Injection in APK bundle (Zip Slip for zip consumers) in github.com/mvt-project/androidqf](https://junglewise.ai/threats/go-2026-5464-androidqf-zip-entry-name-injection-in-apk-bundle-zip-slip-9bcf87bf)
- [GO-2026-5206 - androidqf: APK download Path Traversal in device APK paths in github.com/mvt-project/androidqf](https://junglewise.ai/threats/go-2026-5206-androidqf-apk-download-path-traversal-in-device-apk-paths-95b595d5)
- [mvt-project androidqf path traversal in APK acquisition](https://junglewise.ai/threats/mvt-project-androidqf-path-traversal-in-apk-acquisition-5d75296e)