AGL app-framework-main Critical Zip Slip + TOCTOU Vulnerability (CVE-2026-37531)

The National Vulnerability Database has disclosed CVE-2026-37531, a critical Zip Slip path traversal vulnerability combined with a Time-of-Check to Time-of-Use (TOCTOU) race condition in AGL app-framework-main versions up to 17.1.12. This flaw, rated 9.8 (Critical) on the CVSS scale, allows unauthenticated attackers to write arbitrary files anywhere on the filesystem.

The core issue lies in the widget installation flow. According to the National Vulnerability Database, the is_valid_filename function fails to block dot notation directory traversal sequences, only checking for absolute paths. Crucially, the file extraction via zread occurs before signature verification. Even if the signature check fails, the cleanup process only removes temporary work directory files, leaving maliciously placed files permanently on the system. This pre-authentication, pre-verification file write capability is a catastrophic design flaw.

This isn’t just a theoretical vulnerability; it’s a critical remote code execution vector. An attacker can craft a malicious widget, leverage the path traversal to write executable code to a sensitive location, and then potentially trigger its execution. The fact that files persist even after a failed signature verification means that defenders cannot rely on cryptographic checks to prevent initial compromise. This is a severe threat to the integrity and availability of affected systems.