Skip to content
OpenAdvisories

Package · Go

github.com/mvt-project/androidqf

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • Low —
    GHSA-763j-3p5v-jfc6

    androidqf: APK download Path Traversal in device APK paths

    ### Summary During device acquisition, `getPathToLocalCopy()` constructs local filesystem paths for downloaded APKs using a filename component extracted by `extractFileName()`. The extraction splits on `==/` and takes the remainder without sanitization. If a …

    github.com/mvt-project/androidqf Go
  • Low —
    GHSA-jf2q-463c-6f52

    androidqf: Zip entry Name Injection in APK bundle (Zip Slip for zip consumers)

    ### Summary `generateZipPath()` constructs zip entry names for collected APKs using device controlled content from `extractFileName()`. Since `extractFileName()` does not reject traversal sequences, the resulting zip entry name can contain `../`. AndroidQF it…

    github.com/mvt-project/androidqf Go