A flaw in Automotive Linux’s app‑framework‑main allows a malicious ZIP archive to cause files to be written anywhere on the filesystem. The is_valid_filename check ignores dot‑notation traversal while the subsequent extraction uses openat with the working directory, enabling an attacker to overwrite critical system files. Because extraction occurs before signature verification, a malformed archive can persistently place arbitrary data even if the manifest later fails integrity checks.

The vulnerability affects the Automotive Linux app‑framework‑main component, specifically versions up to and including 17.1.12. Devices running these releases may expose a widget installation interface to potentially untrusted archives.

The CVSS score of 9.8 indicates a critical severity; the exploit probability metric is not available, but the absence from CISA’s KEV list does not mitigate the risk. An attacker could supply a crafted widget package locally or via an exposed distribution channel. The race condition uncovered by the TOCTOU flaw permits the malicious file to survive signature verification failures, granting an attacker persistent write access on the target system.