Path Traversal in Abrignoni Aleapp
CVE-2026-40027
ALEAPP (Android Logs Events And Protobuf Parser) through 3.4.0 contains a path traversal vulnerability in the NQ_Vault.py artifact parser that uses attacker-controlled file_name_from values from a database directly as the output filename, allowing arbitrary file writes outside the report output directory. An attacker can embed a path traversal payload such as ../../../outside_written.bin in the database to write files to arbitrary locations, potentially achieving code execution by overwriting executable files or configuration.
Vulnerability class: Path Traversal (Directory Traversal)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.3 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L.
EPSS exploit prediction
EPSS: 0.002 (8.8th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 9th percentile — 8.8% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.002 · newest: 0.002 · change: +0.000
Affected products
- Abrignoni Aleapp — versions 0, 0cafd8fe0027663420eb3d0fa821b2d1a713880d
Weakness classification (CWE)
References
- github.com/abrignoni/aleapp/pull/669 (issue-tracking, product)
- github.com/abrignoni/ALEAPP/commit/0cafd8fe0027663420eb3d0fa821b2d1a713880d (patch)
- mobasi.ai/sentinel (vendor-advisory)
- www.vulncheck.com/advisories/aleapp-nq-vault-artifact-parser-path-traversal (third-party-advisory)
Frequently asked questions
- What is CVE-2026-40027?
- CVE-2026-40027 is a high-severity vulnerability in Abrignoni Aleapp, classified under Path Traversal. CVSS score: 7.3/10. Published 2026-04-08.
- How severe is CVE-2026-40027?
- High severity. CVSS v3 base score is 7.3 out of 10.