CVE-2026-4741: JoyConDroid Path Traversal Vulnerability

CVE-2026-4741 Overview

A path traversal vulnerability has been identified in TeamJCD JoyConDroid, an Android application that enables using Android devices as game controllers. The vulnerability exists within the UnzipUtil.java file located in the app/src/main/java/com/rdapps/gamepad/util module. This improper limitation of a pathname to a restricted directory (CWE-22) allows attackers to potentially write files outside of the intended extraction directory during archive extraction operations.

Critical Impact

This path traversal vulnerability could allow an attacker to overwrite arbitrary files on the Android device by crafting a malicious archive containing specially crafted file paths, potentially leading to data corruption, application compromise, or code execution.

Affected Products

• JoyConDroid versions through 1.0.93
• TeamJCD JoyConDroid Android application
• Devices running JoyConDroid with archive extraction functionality

Discovery Timeline

• 2026-03-24 - CVE-2026-4741 published to NVD
• 2026-03-24 - Last updated in NVD database

Technical Details for CVE-2026-4741

Vulnerability Analysis

The vulnerability resides in the UnzipUtil.java utility class within JoyConDroid's codebase. Path traversal vulnerabilities in archive extraction utilities occur when the application fails to properly validate and sanitize file paths contained within archive entries before extracting them to the filesystem. When processing archive files (such as ZIP files), the extraction routine does not adequately check whether the destination path resolves to a location outside the intended extraction directory.

An attacker can exploit this by creating an archive containing entries with directory traversal sequences (such as ../) in their filenames. When the application extracts such an archive, these malicious entries could be written to arbitrary locations on the device's filesystem, constrained only by the application's file system permissions.

Root Cause

The root cause is the lack of proper path canonicalization and validation in the UnzipUtil.java file. The extraction logic does not verify that the resolved destination path for each archive entry remains within the designated extraction directory. This allows relative path components like ../ to escape the intended directory boundary, a classic "Zip Slip" vulnerability pattern.

Attack Vector

The attack is network-based and requires user interaction. An attacker must convince a user to download and process a maliciously crafted archive file through the JoyConDroid application. The attack flow typically involves:

1. Attacker creates a specially crafted archive containing entries with path traversal sequences
2. The malicious archive is distributed to potential victims (via download link, email, or other means)
3. Victim opens or processes the archive through JoyConDroid's archive handling functionality
4. The application extracts files to locations outside the intended directory
5. Depending on the overwritten files and application permissions, this could lead to data corruption, configuration tampering, or potential code execution

The vulnerability mechanism involves improper handling of archive entry paths. When extracting files, the application should validate that the final resolved path remains within the designated extraction directory. Without this validation, an archive entry named ../../../sensitive_file would be extracted several directories above the intended location. For technical details, see the GitHub Pull Request.

Detection Methods for CVE-2026-4741

Indicators of Compromise

• Unexpected files appearing in application directories or parent directories after archive extraction
• Modified configuration files or data files outside of expected JoyConDroid directories
• Application behavior changes or crashes following archive processing operations
• File system audit logs showing file writes to unexpected locations during JoyConDroid usage

Detection Strategies

• Monitor file system operations during JoyConDroid archive extraction for writes outside designated directories
• Implement application-level logging to track archive extraction operations and destination paths
• Use mobile device management (MDM) solutions to detect unauthorized file modifications
• Review application logs for extraction operations involving .. path sequences

Monitoring Recommendations

• Enable comprehensive file system auditing on devices running vulnerable JoyConDroid versions
• Configure alerts for file modifications in sensitive application directories
• Monitor for unusual network activity that may indicate malicious archive downloads
• Implement endpoint detection rules for Zip Slip attack patterns on mobile devices

How to Mitigate CVE-2026-4741

Immediate Actions Required

• Upgrade JoyConDroid to a version newer than 1.0.93 that includes the security fix
• Review the GitHub Pull Request #124 for patch details
• Avoid processing archive files from untrusted sources until the application is updated
• Consider temporarily uninstalling JoyConDroid if archive functionality is not essential

Patch Information

A fix for this vulnerability is available via GitHub Pull Request #124. Users should update to the latest version of JoyConDroid that incorporates this fix. The patch addresses the path traversal issue by implementing proper validation of archive entry paths before extraction.

Workarounds

• Disable or avoid using any archive extraction features within JoyConDroid until patched
• Only process archives from trusted and verified sources
• Use alternative, verified tools for any archive extraction needs
• Implement device-level restrictions on file write operations for the JoyConDroid application

The recommended mitigation approach involves validating that extracted file paths resolve within the intended directory. Proper path canonicalization and boundary checking should be implemented in the extraction logic. Users should monitor the TeamJCD JoyConDroid GitHub repository for official releases containing the security fix.