CVE-2026-37531 - Vulnerability Analysis

Overview

AGL app-framework-main thru 17.1.12 contains a path traversal combined with a TOCTOU race condition caused by improper validation of ZIP entry names and extraction order in widget installation flow, letting attackers write files anywhere on the filesystem before signature verification, exploit requires crafted malicious ZIP files.

Severity & Score

Impact

Attackers can write arbitrary files anywhere on the filesystem, potentially leading to code execution or system compromise.

Mitigation

Update to a version that performs signature verification before extraction and properly validates ZIP entry names, or upgrade to the latest version.

References

• https://gerrit.automotivelinux.org/gerrit/src/app-framework-main
• https://gist.github.com/sgInnora/8526eedcfd826d05ef1fc45d8f405643

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner