---
id: CVE-2026-40027
title: ALEAPP NQ Vault Artifact Parser Path Traversal
summary: >-
  ALEAPP (Android Logs Events And Protobuf Parser) through 3.4.0 contains a path
  traversal vulnerability in the NQ_Vault.py artifact parser that uses
  attacker-controlled file_name_from values from a database directly as the
  output filename…
severity: high
cvss: 7.3
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L'
cvssSource: cna
cwe:
  - CWE-22
vendor: abrignoni
product: ALEAPP
affected:
  - ALEAPP <= 3.4.0
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-04-09T13:41:15.548081Z'
published: '2026-04-08'
updated: '2026-11-08'
sourceUpdated: '2026-11-08T14:02:40.246Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-40027'
references:
  - url: 'https://github.com/abrignoni/aleapp/pull/669'
    label: Pull Request
  - url: >-
      https://github.com/abrignoni/ALEAPP/commit/0cafd8fe0027663420eb3d0fa821b2d1a713880d
    label: Patch Commit
  - url: 'https://mobasi.ai/sentinel'
    label: Mobasi Sentinel Vulnerability Index
  - url: >-
      https://www.vulncheck.com/advisories/aleapp-nq-vault-artifact-parser-path-traversal
    label: 'VulnCheck Advisory: ALEAPP NQ Vault Artifact Parser Path Traversal'
tags:
  - cve.org
epss: 0.00195
epssPercentile: 0.09262
ingestedAt: '2026-11-08T14:51:22.447Z'
---

## Overview

ALEAPP (Android Logs Events And Protobuf Parser) through 3.4.0 contains a path traversal vulnerability in the NQ_Vault.py artifact parser that uses attacker-controlled file_name_from values from a database directly as the output filename, allowing arbitrary file writes outside the report output directory. An attacker can embed a path traversal payload such as ../../../outside_written.bin in the database to write files to arbitrary locations, potentially achieving code execution by overwriting executable files or configuration.

## Affected

- `ALEAPP <= 3.4.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.