Description

ALEAPP (Android Logs Events And Protobuf Parser) through 3.4.0 contains a path traversal vulnerability in the NQ_Vault.py artifact parser that uses attacker-controlled file_name_from values from a database directly as the output filename, allowing arbitrary file writes outside the report output directory. An attacker can embed a path traversal payload such as ../../../outside_written.bin in the database to write files to arbitrary locations, potentially achieving code execution by overwriting executable files or configuration.

INFO

Published Date :

2026-04-08T21:35:23.178Z

Last Modified :

2026-04-09T13:41:25.490Z

Source :

VulnCheck
AFFECTED PRODUCTS

The following products are affected by CVE-2026-40027 vulnerability.

Vendors Products
Abrignoni
  • Aleapp
REFERENCES

Here, you will find a curated list of external links that provide in-depth information to CVE-2026-40027.

URL Resource
https://github.com/abrignoni/ALEAPP/commit/0cafd8fe0027663420eb3d0fa821b2d1a713880d cve-icon cve-icon
https://github.com/abrignoni/aleapp/pull/669 cve-icon cve-icon
https://mobasi.ai/sentinel cve-icon cve-icon
https://www.vulncheck.com/advisories/aleapp-nq-vault-artifact-parser-path-traversal cve-icon cve-icon
Login to claim this CVE

CVSS Vulnerability Scoring System

Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Attack Requirements
Privileges Required
User Interaction
VS Confidentiality
VS Integrity
VS Availability
SS Confidentiality
SS Integrity
SS Availability
Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality Impact
Integrity Impact
Availability Impact