CVE-2026-37531

The `is_valid_filename` function in the `wgtpkg-zip.c` file verifies ZIP archive entry names, but only blocks absolute paths — it does not check sequences containing dot notation (e.g., `../`). The `zread` function performs extraction using `openat(workdirfd, filename, O_CREAT)`, which resolves relative paths outside the working directory and enables files to be written anywhere on the system. The critical TOCTOU race condition lies in the `install_widget` function (in `wgtpkg-install.c`) where file extraction by `zread` occurs BEFORE signature verification by `check_all_signatures`. Even if signature verification fails, the cleanup procedure `remove_workdir` only removes files from the temporary directory — files written outside it via path traversal remain on the file system permanently.

An unauthenticated attacker can write arbitrary files to any location on the device's file system, which in practice enables permanent system takeover, privilege escalation, or malicious code injection — even if the supplied widget has an invalid signature.

Apply patches available from the manufacturer according to the references. Temporarily restrict widget installation to trusted, authenticated sources and monitor the integrity of critical file system resources. It is recommended to monitor the project repository at https://gerrit.automotivelinux.org/gerrit/src/app-framework-main to obtain current fixes.

AGL app-framework-main in versions up to and including 17.1.12.