CVE-2026-37531 Details
Description
AGL app-framework-main thru 17.1.12 contains a Zip Slip path traversal vulnerability (CWE-22) combined with a TOCTOU race condition (CWE-367) in the widget installation flow. The is_valid_filename function in wgtpkg-zip.c validates ZIP entry names but does not check for dot notation directory traversal sequences it only blocks absolute paths. The zread extraction function uses openat(workdirfd, filename, O_CREAT) which resolves dot notation values relative to the work directory, allowing files to be written anywhere on the filesystem. Critically, in function install_widget in file wgtpkg-install.c, extraction via zread occurs BEFORE signature verification via check_all_signatures. Even if signature verification fails, the error cleanup (remove_workdir) only deletes the temporary work directory files written outside via path traversal persist permanently.
A Zip Slip path traversal vulnerability combined with a TOCTOU race condition has been identified in the AGL app-framework-main version 17.1.12 and prior, within the widget installation process. The vulnerability arises because the is_valid_filename function in wgtpkg-zip.c only blocks absolute paths and fails to validate ZIP entry names against dot notation directory traversal sequences. This oversight allows crafted ZIP files to exploit the zread extraction function, which writes files anywhere on the filesystem relative to the work directory. Notably, the extraction occurs before signature verification, enabling the installation of potentially malicious widgets. If signature verification fails, only the temporary files in the work directory are removed, leaving behind any files written through the path traversal vulnerability.
It is recommended to normalize and validate all archive entry paths against the target directory before extraction.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 1, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://gerrit.automotivelinux.org/gerrit/src/app-framework-main | [email protected] | Broken Link |
| https://gist.github.com/sgInnora/8526eedcfd826d05ef1fc45d8f405643 | [email protected] | Third Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | CISA-ADP |
| CWE-367 | Time-of-check Time-of-use (TOCTOU) Race Condition | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| linuxfoundation automotive grade linux | <= 17.1.12 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 18, 2026 | Initial Analysis | [email protected] |
| May 1, 2026 | CVE Modified | CISA-ADP |
| May 1, 2026 | New CVE Received | [email protected] |