CVE-2026-37531:

CVE-2026-37531 is a critical vulnerability in AGL app-framework-main through version 17.1.12 that combines a Zip Slip path traversal flaw (CWE-22) with a TOCTOU race condition (CWE-367) in the widget installation process, allowing unauthenticated remote attackers to write arbitrary files anywhere on the filesystem.

CVE-2026-37531 affects AGL app-framework-main through version 17.1.12 and represents a critical-severity, remotely exploitable vulnerability chain found in the widget installation subsystem. The flaw arises from two compounding weaknesses: an incomplete filename validation routine that fails to block dot-notation path traversal sequences, and a procedural ordering error where archive extraction occurs before cryptographic signature verification. As a result, an attacker can craft a malicious ZIP-based widget package containing traversal sequences in entry names, causing the extraction logic to write files to arbitrary locations on the target filesystem. Critically, even if the subsequently executed signature verification step rejects the package, the cleanup process only removes temporary working files and leaves all traversal-planted files intact. This effectively means signature verification provides no protective barrier against arbitrary file write attacks. The vulnerability requires no authentication, no user interaction, and is exploitable over the network, making it particularly dangerous in any deployment where the widget installation interface is accessible remotely. The combination of CWE-22 (Path Traversal) and CWE-367 (TOCTOU Race Condition) means that standard mitigations addressing either weakness in isolation would be insufficient to fully remediate the risk.