ALEAPP, a parser for Android log events, has a path traversal flaw in its NQ_Vault.py artifact parser. The vulnerability arises when the parser writes output files using file names pulled directly from a database entry. An attacker can embed a traversal payload like '../../../outside_written.bin' in the database, causing ALEAPP to create or overwrite files outside its intended report directory. This permits arbitrary file writes and can lead to execution of malicious code by replacing executables or altering configuration files.

The flaw affects all installations of ALEAPP prior to version 3.4.0 compiled from the abrignoni repository. The affected product is ALEAPP, version 3.4.0 and older. As the vulnerability originates in the NQ_Vault.py module, any system relying on that parser for processing NQ Vault artifacts is susceptible.

The CVSS base score is 8.4, indicating high severity. No EPSS score is reported, and the issue has not been cataloged in the CISA KEV list. The exploit requires an attacker with write access to the database entry or the ability to influence the data used by ALEAPP. Given the potential for arbitrary file writes, a successful exploitation could result in code execution or system compromise. The vector is likely local or restricted to the environment where ALEAPP processes logs, but remote attackers with database access could also leverage it.