ADB Explorer allows an unvalidated command-line path argument; on startup and exit it recursively deletes all subdirectories of that path, bypassing the Recycle Bin. An attacker can craft a malicious shortcut or batch script containing a critical directory (e.g., C:\Users\%USERNAME%\Documents) as the argument, which results in permanent recursive deletion of its contents. The impact is the loss of user data and potential disruption of local services. The flaw is a reference and path traversal weakness (CWE-22 and CWE-73). The vulnerability is local, requiring legitimate user execution of the application with a crafted argument, but because it is the normal functioning of a widely used tool, social engineering or simple user interaction can trigger exploitation.

The vulnerability is present in Alex4SSB ADB‑Explorer version 0.9.26020 and earlier. The affected product is the Windows‑based ADB Explorer tool distributed by Alex4SSB.

The CVSS score is 7.1, indicating high severity, while the EPSS score is less than 1 %, suggesting low probability of exploitation in the wild. The flaw is not listed in CISA’s KEV catalog. Exploitation requires an attacker to provide a malicious command‑line argument to a locally installed instance of ADB Explorer, typically via a crafted shortcut, batch file or script. Once executed, the application deletes the specified directory tree unconditionally, making data recovery difficult. The attack vector is therefore local but practical, and if an attacker gains access to drive folders such as Documents or AppData, the loss can be significant.