CVE-2026-40027

Name of the Vulnerable Software and Affected Versions ALEAPP (Android Logs Events And Protobuf Parser) versions prior to 3.4.1

Description The NQ Vault.py artifact parser contains a path traversal flaw. This occurs because the parser uses the file name from variable, which is controlled by an attacker via a database, directly as the output filename. This allows arbitrary file writes outside the designated report output directory. By embedding a path traversal payload, such as ../../../outside written.bin, an attacker can write files to arbitrary locations, which may lead to code execution by overwriting configuration or executable files.

Recommendations Update ALEAPP (Android Logs Events And Protobuf Parser) to version 3.4.1 or later.