HF RL Explorer

Arbitrary file write via path traversal in resource names during APK decoding

Arbitrary file write via path traversal in resource names during APK decoding: a task in LegoFlow-SWE (Harbor dataset). When decoding an APK that contains a maliciously crafted resource name with path traversal sequences (e.g., ../../poc ), the extracted file is written outside the intended output…

The task

When decoding an APK that contains a maliciously crafted resource name with path traversal sequences (e.g., `../../poc`), the extracted file is written outside the intended output directory. This can overwrite arbitrary files on the system.

Part of Lego-X/LegoFlow-SWE.