Read the docs
TI-2026-28059 Aliases CVE-2026-37531GHSA-v8g5-w742-7rxg

AGL app-framework-main thru 17.1.12 contains a Zip Slip path traversal vulnerability…

Priority MEDIUM 50CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

AGL app-framework-main thru 17.1.12 contains a Zip Slip path traversal vulnerability (CWE-22) combined with a TOCTOU race condition (CWE-367) in the widget installation flow. The is_valid_filename function in wgtpkg-zip.c validates ZIP entry names but does not check for dot notation directory traversal sequences it only blocks absolute paths. The zread extraction function uses openat(workdirfd, filename, O_CREAT) which resolves dot notation values relative to the work directory, allowing files to be written anywhere on the filesystem. Critically, in function install_widget in file wgtpkg-install.c, extraction via zread occurs BEFORE signature verification via check_all_signatures. Even if signature verification fails, the error cleanup (remove_workdir) only deletes the temporary work directory files written outside via path traversal persist permanently.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00711 53rd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:o:linuxfoundation:automotive_grade_linux:*:*:*:*:*:*:*:*up to 17.1.12Vulnerablebackstage
  • cpe:2.3:o:linuxfoundation:automotive_grade_linux:*:*:*:*:*:*:*:* Versions up to 17.1.12 Vulnerable ·backstage

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-37531
  2. 2026-10-03 Alias added: GHSA-v8g5-w742-7rxg

References

Advisory 1

Other 1

  • TI-2026-28058 AGL agl-service-can-low-level thru 17.1.12 contains a stack buffer overflow in the uds-c… CVSS 3.1HIGH 7.5
  • TI-2026-28057 AGL app-framework-binder (afb-daemon) through v19.90.0 allows any local process to… CVSS 3.1HIGH 7.8
  • TI-2026-28056 AGL app-framework-binder (afb-daemon) through v19.90.0 contains a privilege escalation… CVSS 3.1HIGH 7.8
  • TI-2026-28060 AGL agl-service-can-low-level thru 17.1.12 contains a heap buffer over-read in the… CVSS 3.1HIGH 7.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences