{"id":"CVE-2026-40027","title":"ALEAPP NQ Vault Artifact Parser Path Traversal","summary":"ALEAPP (Android Logs Events And Protobuf Parser) through 3.4.0 contains a path traversal vulnerability in the NQ_Vault.py artifact parser that uses attacker-controlled file_name_from values from a database directly as the output filename…","severity":"high","cvss":7.3,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L","cvssSource":"cna","cwe":["CWE-22"],"vendor":"abrignoni","product":"ALEAPP","affected":["ALEAPP <= 3.4.0"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-04-09T13:41:15.548081Z"},"published":"2026-04-08","updated":"2026-11-08","sourceUpdated":"2026-11-08T14:02:40.246Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-40027","references":[{"url":"https://github.com/abrignoni/aleapp/pull/669","label":"Pull Request"},{"url":"https://github.com/abrignoni/ALEAPP/commit/0cafd8fe0027663420eb3d0fa821b2d1a713880d","label":"Patch Commit"},{"url":"https://mobasi.ai/sentinel","label":"Mobasi Sentinel Vulnerability Index"},{"url":"https://www.vulncheck.com/advisories/aleapp-nq-vault-artifact-parser-path-traversal","label":"VulnCheck Advisory: ALEAPP NQ Vault Artifact Parser Path Traversal"}],"tags":["cve.org"],"epss":0.00195,"epssPercentile":0.09262,"ingestedAt":"2026-11-08T14:51:22.447Z","slug":"CVE-2026-40027","body":"## Overview\n\nALEAPP (Android Logs Events And Protobuf Parser) through 3.4.0 contains a path traversal vulnerability in the NQ_Vault.py artifact parser that uses attacker-controlled file_name_from values from a database directly as the output filename, allowing arbitrary file writes outside the report output directory. An attacker can embed a path traversal payload such as ../../../outside_written.bin in the database to write files to arbitrary locations, potentially achieving code execution by overwriting executable files or configuration.\n\n## Affected\n\n- `ALEAPP <= 3.4.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":40,"depthScoreParts":{"impact":40.2,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}