Skip to content
Heist/ feed
Back to feed
High

ALEAPP NQ Vault Artifact Parser Path Traversal

Type: advisorySources: OSV

ALEAPP (Android Logs Events And Protobuf Parser) through 3.4.0 contains a path traversal vulnerability in the NQ_Vault.py artifact parser that uses attacker-controlled file_name_from values from a database directly as the output filename, allowing arbitrary file writes outside the report output directory. An attacker can embed a path traversal payload such as ../../../outside_written.bin in the database to write files to arbitrary locations, potentially achieving code execution by overwriting executable files or configuration.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2026-40027
Confirmed fixed CVEs
Not specified
Updated in this feed
7 Nov 2026, 04:00 UTC · Revision 1

Source evidence

ALEAPP NQ Vault Artifact Parser Path Traversal

core-osv · Original source

Published 8 Apr 2026, 21:35 UTC

ALEAPP (Android Logs Events And Protobuf Parser) through 3.4.0 contains a path traversal vulnerability in the NQ_Vault.py artifact parser that uses attacker-controlled file_name_from values from a database directly as the output filename, allowing arbitrary file writes outside the report output directory. An attacker can embed a path traversal payload such as ../../../outside_written.bin in the database to write files to arbitrary locations, potentially achieving code execution by overwriting executable files or configuration.

osv:CVE-2026-40027
Complete source record
{
  "id": "9736a2904d20871332960d64f19b1d7b50cfb9959b2f5a78656d52b9653a84af",
  "url": "https://osv.dev/vulnerability/CVE-2026-40027",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "ALEAPP NQ Vault Artifact Parser Path Traversal",
    "summary": "ALEAPP (Android Logs Events And Protobuf Parser) through 3.4.0 contains a path traversal vulnerability in the NQ_Vault.py artifact parser that uses attacker-controlled file_name_from values from a database directly as the output filename, allowing arbitrary file writes outside the report output directory. An attacker can embed a path traversal payload such as ../../../outside_written.bin in the database to write files to arbitrary locations, potentially achieving code execution by overwriting executable files or configuration.",
    "evidence": "osv:CVE-2026-40027",
    "products": [],
    "severity": "high",
    "structured": {
      "id": "CVE-2026-40027",
      "aliases": [
        "CVE-2026-40027"
      ],
      "metrics": [
        {
          "type": "CVSS_V4",
          "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/abrignoni/aleapp",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "0cafd8fe0027663420eb3d0fa821b2d1a713880d"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "last_affected": "3.4.0"
                      }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StandardRange"
                  },
                  {
                    "range": [
                      {
                        "fixed": "0cafd8fe0027663420eb3d0fa821b2d1a713880d"
                      }
                    ],
                    "source": "REFERENCES_COMMIT"
                  }
                ]
              }
            }
          ],
          "versions": [
            "v3.4.0",
            "v3.3.0",
            "v3.2.5",
            "v3.2.4",
            "v3.2.3",
            "v3.2.2",
            "v3.2.1",
            "v3.1.9",
            "v3.1.8",
            "v3.1.6",
            "v3.1.5",
            "v3.1.1",
            "v3.0.0",
            "v2.0.09",
            "v2.0.05",
            "v2.0.03",
            "v1.8.0",
            "v1.7.2",
            "v1.7.1",
            "v1.7.0",
            "v1.3.1",
            "1.3",
            "1.2"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-40027.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:49.607442506Z",
      "provider": "osv",
      "references": [
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40027.json",
        "https://mobasi.ai/sentinel",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-40027",
        "https://www.vulncheck.com/advisories/aleapp-nq-vault-artifact-parser-path-traversal",
        "https://github.com/abrignoni/aleapp/pull/669",
        "https://github.com/abrignoni/ALEAPP/commit/0cafd8fe0027663420eb3d0fa821b2d1a713880d"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-22"
        ],
        "cna_assigner": "VulnCheck",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40027.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-40027",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 517954,
  "published_at": "2026-04-08T21:35:23.178+00:00"
}